> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scanova.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Management API overview

> The complete Scanova Management API — everything available at management.scanova.io, plus token creation and usage stats.

The **Management API** is the programmatic interface for everything you can do in the Scanova dashboard: create and update QR codes, manage folders and tags, read leads and form submissions, pull analytics, and manage shared users and roles. It's a separate host from the rest of Scanova's API surface, with its own authentication scheme.

<Note>
  This page covers the architecture that applies to every Management API endpoint. For the full endpoint list, see the pages linked at the bottom of this page.
</Note>

## Two hosts, two authentication schemes

This is the single most common source of confusion when integrating with the Management API, so read this section before writing any code.

|                  | Token management                                                                                                | Data endpoints                                                                                 |
| :--------------- | :-------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------- |
| **Host**         | `qcg-api.scanova.io` (the regular Scanova API host)                                                             | `management.scanova.io` (a dedicated host)                                                     |
| **Auth**         | Your normal logged-in dashboard session — an OAuth access token, sent as `Authorization: Bearer <access_token>` | A raw Management API key, sent as `Authorization: <key>` — **no prefix at all**                |
| **Endpoints**    | `console/token/*`, `console/usage/*`                                                                            | `qr/`, `qrcode/`, `folder/`, `tag/`, `lead/`, `forms/`, `analytics/`, `plans/`, `multi-users/` |
| **Who calls it** | You, once, from a trusted backend or admin tool, to create/manage/monitor keys                                  | Your integration, on every request that reads or writes QR/folder/lead/etc. data               |

In other words: you authenticate as *yourself* (your dashboard login) to create a Management API key, and you authenticate as *the key* to actually use the Management API.

<Warning>
  The `Authorization` header for the data host takes the raw key and nothing else. A header with more than one space-separated part — `Bearer <key>`, `Token <key>`, or anything similar — is rejected outright. Send exactly:

  ```
  Authorization: 401f7ac837da42b97f613d789819ff93537bee6a
  ```

  This also means requests to the data endpoints must have their `Host` header set to `management.scanova.io` — sending the same key to `qcg-api.scanova.io` will not authenticate.
</Warning>

## Getting started

<Steps>
  <Step title="Create a Management API key">
    While logged into the Scanova dashboard, create a key via [`POST /console/token/`](/api-reference/management-api/tokens/create) (or the dashboard's key-management UI, see [Creating & managing API keys](/api-keys/creating-and-managing-keys)). Choose an `environment` — `sandbox`, `live`, `zapier`, or `mcp` — when you create it; this choice is permanent for that key and determines which plan quota is checked on every request the key makes (see below).
  </Step>

  <Step title="Store the key's raw value">
    The key value returned by the create call is the only time you'll see it in full — store it securely. There's no "reveal" endpoint after the fact.
  </Step>

  <Step title="Call the data endpoints">
    Send the key as the raw `Authorization` header value against `management.scanova.io`, for example [`GET /qr/`](/api-reference/management-api/qr/list) to list your QR codes.
  </Step>
</Steps>

## Plan quota

Every request to a data endpoint checks a plan quota tied to the key's `environment`:

| `environment`       | Quota checked        | Also requires                                                |
| :------------------ | :------------------- | :----------------------------------------------------------- |
| `live` or `sandbox` | `MANAGEMENT_API`     | —                                                            |
| `zapier`            | `INTEGRATION_ZAPIER` | The request's `User-Agent` header must literally be `zapier` |
| `mcp`               | `INTEGRATION_MCP`    | The request's `User-Agent` header must literally be `mcp`    |

<Note>
  If a request to the data host returns `401` with the message **"Your plan does not have management API quota"** (or the Zapier/MCP-specific equivalents), your plan doesn't grant that quota. Today, the canonical Pro plan does not include Management API access — only Free Trial, Enterprise, and Internal plans do. Contact [support@scanova.io](mailto:support@scanova.io) if you believe your account should have it.
</Note>

<Warning>
  `sandbox` is a labeling and quota concept only — it is **not** an isolated test environment. A key created with `environment: sandbox` reads and writes the same real QR codes, folders, and leads as a `live` key. Don't rely on it for throwaway test data.
</Warning>

A `zapier`/`mcp` key additionally only authenticates when the calling client's `User-Agent` header matches its environment — a `zapier` key rejects requests unless `User-Agent: zapier`, and likewise for `mcp`. This is enforced independently of the quota check above.

## What's in this section

<CardGroup cols={2}>
  <Card title="Create an API token" icon="key" href="/api-reference/management-api/tokens/create">
    `POST /console/token/` — generate a new key for a chosen environment.
  </Card>

  <Card title="Remove an API token" icon="trash" href="/api-reference/management-api/tokens/remove">
    `DELETE /console/token/{key}/` — revoke a key immediately.
  </Card>

  <Card title="Usage statistics" icon="chart-line" href="/api-reference/management-api/tokens/usage-stats">
    `GET /console/usage/` — request counts over a rolling window.
  </Card>

  <Card title="List QR codes" icon="qrcode" href="/api-reference/management-api/qr/list">
    `GET /qr/` — the core data endpoint most integrations start with.
  </Card>

  <Card title="Create a QR code" icon="qrcode" href="/api-reference/management-api/qr/create">
    `POST /qr/` — the core data endpoint most integrations start with.
  </Card>
</CardGroup>

See the sidebar for the full list, including retrieving/updating/deleting a single QR code, downloading QR images, and browsing the trash.

## Related

* [API Reference introduction](/api-reference/getting-started/introduction) — the parent section this overview belongs to.
* [Create an API token](/api-reference/management-api/tokens/create) — generate the key this whole API surface authenticates with.
* [List QR codes](/api-reference/management-api/qr/list) — the core data endpoint most integrations start with.
* [Create a QR code](/api-reference/management-api/qr/create) — the core data endpoint most integrations start with.
* [MCP overview](/mcp/overview) — an integration built entirely on this same API, using a dedicated `mcp` environment.