Authentication

The API authenticates each request with a token generated in the dashboard. The token determines which links your integration can access and uses the quota provided by your plan.

Send the token in the header

Authorization: Bearer YOUR_TOKEN

Include this header in every request. Missing, invalid, expired, or revoked tokens return HTTP 401. Documentation examples read the token from the PQNO_TOKEN environment variable.

Personal and company access

• Pro: a personal token can manage links created by the person who generated it.
• Business: a company administrator generates a company token to manage links created by anyone in that company. The daily quota is shared across the company.

The criado_por field identifies each link's creator. A company token can filter the list by usuario and retrieve per-person metrics in Account summary. Links created with this token are attributed to the administrator who generated it.

QR code generation using link_id or perfil accesses the token issuer's links and Link in Bio. For another person's link within the company, retrieve its url_curta and send it as conteudo, as described in Generate a QR code.

Manage tokens in the dashboard

Open API to generate a token with a label and an expiration period from 24 hours to 1 year. The screen also shows Today's quotas and Your tokens, including their status, creation date, and last use.

To replace a token, generate a new one, update your integration, and confirm that requests work before revoking the previous token. Revocation takes effect immediately and cannot be undone: the next request using the revoked token returns 401.

Understand access denials

HTTP 403 means the token was recognized but cannot authorize the operation. This can happen when the plan no longer includes API access, the account is deactivated, or the administrator who generated a company token loses that role.

Access may be restored when the underlying condition is resolved, provided the token is still valid and has not been revoked. Check Responses and errors before generating a replacement token.

Store tokens securely

• Use a separate token for each integration so you can revoke access independently.
• Store tokens on your server, outside your repository and request logs.
• Make authenticated requests from your server; distributing tokens in browser or application code exposes them.
• Use short expiration periods for testing and replace production tokens before they expire.
• Revoke an exposed token immediately and generate a replacement.