Skip to main content
The Management API is the programmatic interface for everything you can do in the Scanova dashboard: create and update QR codes, manage folders and tags, read leads and form submissions, pull analytics, and manage shared users and roles. It’s a separate host from the rest of Scanova’s API surface, with its own authentication scheme.
This page covers the architecture that applies to every Management API endpoint. For the full endpoint list, see the pages linked at the bottom of this page.

​
Two hosts, two authentication schemes

This is the single most common source of confusion when integrating with the Management API, so read this section before writing any code. In other words: you authenticate as yourself (your dashboard login) to create a Management API key, and you authenticate as the key to actually use the Management API.
The Authorization header for the data host takes the raw key and nothing else. A header with more than one space-separated part — Bearer <key>, Token <key>, or anything similar — is rejected outright. Send exactly:
This also means requests to the data endpoints must have their Host header set to management.scanova.io — sending the same key to qcg-api.scanova.io will not authenticate.

​
Getting started

1

Create a Management API key

While logged into the Scanova dashboard, create a key via POST /console/token/ (or the dashboard’s key-management UI, see Creating & managing API keys). Choose an environment — sandbox, live, zapier, or mcp — when you create it; this choice is permanent for that key and determines which plan quota is checked on every request the key makes (see below).
2

Store the key's raw value

The key value returned by the create call is the only time you’ll see it in full — store it securely. There’s no “reveal” endpoint after the fact.
3

Call the data endpoints

Send the key as the raw Authorization header value against management.scanova.io, for example GET /qr/ to list your QR codes.

​
Plan quota

Every request to a data endpoint checks a plan quota tied to the key’s environment:
If a request to the data host returns 401 with the message “Your plan does not have management API quota” (or the Zapier/MCP-specific equivalents), your plan doesn’t grant that quota. Today, the canonical Pro plan does not include Management API access — only Free Trial, Enterprise, and Internal plans do. Contact support@scanova.io if you believe your account should have it.
sandbox is a labeling and quota concept only — it is not an isolated test environment. A key created with environment: sandbox reads and writes the same real QR codes, folders, and leads as a live key. Don’t rely on it for throwaway test data.
A zapier/mcp key additionally only authenticates when the calling client’s User-Agent header matches its environment — a zapier key rejects requests unless User-Agent: zapier, and likewise for mcp. This is enforced independently of the quota check above.

​
What’s in this section

Create an API token

POST /console/token/ — generate a new key for a chosen environment.

Remove an API token

DELETE /console/token/{key}/ — revoke a key immediately.

Usage statistics

GET /console/usage/ — request counts over a rolling window.

List QR codes

GET /qr/ — the core data endpoint most integrations start with.

Create a QR code

POST /qr/ — the core data endpoint most integrations start with.
See the sidebar for the full list, including retrieving/updating/deleting a single QR code, downloading QR images, and browsing the trash.