Authentication

Every QUiCK API call is authenticated. Authentication is API token based: the token travels in the Authorization header on every request, prefixed with Token.

GET /1/partners/ HTTP/1.1
Host: api.quick.riport.co.hu
Authorization: Token 9c4f2e7a8b1d43f0a6e5c2b9d8f70123
Accept: application/json

If the header is missing or the token is invalid, the response is 401 Unauthorized. If the token is valid but lacks permission for the company or the operation, the response is 403 Forbidden.

Some /2/ endpoints accept an optional Quick-Company-Id header that selects the target company explicitly:

GET /2/expense-types/ HTTP/1.1
Host: api.quick.riport.co.hu
Authorization: Token 9c4f2e7a8b1d43f0a6e5c2b9d8f70123
Quick-Company-Id: 4821

• If you omit it, the company is inferred from the token — this is the usual case.
• If you send it and it does not match the token's company, the response is 403 Forbidden.

Your company id is returned by GET /2/company-info/ (see below).

Tokens are created in the QUiCK app, under company settings. The Administrator role is required.

1. Sign in to the QUiCK app, then click the company name in the top right to open the company switcher.
2. In the My companies list, click the gear icon next to the company — this opens its settings.
3. Scroll to the API Tokens section and click Create new API token.
4. Give the token a descriptive name reflecting where you use it (for example „Webshop sync" or „Power BI report").
5. Click Create.
6. The token is shown only once, at creation time. Click Copy token and store it somewhere safe.

With a token in hand, GET /2/company-info/ returns the base data of the token's company — including the id you may need for the Quick-Company-Id header.

curl https://api.quick.riport.co.hu/2/company-info/ \
  -H "Authorization: Token $QUICK_API_TOKEN"

{
  "id": 4821,
  "name": "Riport Applications Kft.",
  "tax_account_number": "12345678-2-42",
  "default_currency_name": "HUF",
  "expense_email": "expenses@example.com",
  "document_email": "documents@example.com",
  "advanced_accounting": true,
  "enable_accounting_id": true,
  "enable_vat_period": true
}

Pick the store that matches your environment — the token must never reach version control or a client-side bundle.

• Local development: a .env file listed in .gitignore, loaded with dotenv
• Server (VPS, container): an environment variable at the service-manager level (systemd, Docker)
• CI/CD: a secret variable (GitHub Actions secret, GitLab CI variable)
• Managed platform: the native secret store (AWS Secrets Manager, Vercel env, Cloudflare secrets)

export QUICK_API_TOKEN="9c4f2e7a8b1d43f0a6e5c2b9d8f70123"

If your integration serves several companies, create a separate token per company (each in that company's settings). You route calls to the right company by selecting the matching token; the Quick-Company-Id header is only needed when you want to bind a request to a specific company explicitly and have the API verify it.