Recipe

Authenticating API requests

Every call must send a valid API token in the Authorization header — how to create, store and use it.

Beginner~15 min5 steps

Prerequisites

A QUiCK account with the Administrator role
A backend environment where you can store a secret (not a browser)

1. Create an API token

In the QUiCK app, with the Administrator role:

Click the company name in the top right to open the company switcher.
In the My companies list, click the gear icon next to the company.
Scroll to the API Tokens section → Create new API token.
Give it a descriptive name (for example „Webshop sync") → Create.
Click Copy token.

The token is shown only once

We display the full value only at creation time. If you lose it, delete the token and create a new one.

2. Store the token as a secret

Never hard-code it. Use the secret store of your hosting platform (Vercel/Netlify env, Kubernetes Secret, AWS Secrets Manager, …).

bash

# for local development
echo 'QUICK_API_TOKEN=9c4f2e7a8b1d43f0a6e5c2b9d8f70123' >> .env.local

3. The Authorization header format

Every call uses the same fixed format: Authorization: Token <token>. The word Token and the space are required (it is not Bearer).

http

GET /1/partners/ HTTP/1.1
Host: api.quick.riport.co.hu
Authorization: Token 9c4f2e7a8b1d43f0a6e5c2b9d8f70123
Accept: application/json

Quick check:

bash

curl -i https://api.quick.riport.co.hu/1/pulse/ \
  -H "Authorization: Token $QUICK_API_TOKEN" | head -1

4. Company scope (optional)

The token is bound to one company, so the company is inferred from it by default. To state it explicitly, send the Quick-Company-Id header:

bash

curl https://api.quick.riport.co.hu/2/expense-types/ \
  -H "Authorization: Token $QUICK_API_TOKEN" \
  -H "Quick-Company-Id: 4821"

Your company id comes from GET /2/company-info/. If the id does not match the token''s company, the response is 403.

5. Debugging 401 / 403

401 — missing or invalid token. Check that the header is exactly Authorization, the prefix is Token (with a space), and no newline or quote is left at the end of the token (a common .env loader mistake).
403 — the token is valid but lacks permission: either for the operation, or the Quick-Company-Id is not the token''s company.

The error response is always flat: {"_error": "..."}.

Related endpoints

GET/v1/ping
POST/v1/auth/keys

Related terms

partner expense

Common pitfalls

Sending a Bearer prefix instead of Token

The QUiCK Public API expects the `Authorization: Token <token>` format. Both `Bearer <token>` and a bare value return 401.

The token ends up in the frontend

The API token is a server-side secret granting access to all company accounting data. Instead of calling from the browser, put your own backend proxy in front that appends the header based on the session.

Sending Quick-Company-Id unnecessarily

The company follows from the token. If you send the wrong company in the header, you get a 403 even on calls that would otherwise work.