curl -X POST "https://qcg-api.scanova.io/console/token/" \
-H "Authorization: Bearer <your_oauth_access_token>" \
-H "Content-Type: application/json" \
-d '{
"name": "Zapier — production",
"environment": "zapier",
"expiry": 365
}'
{
"name": "Zapier — production",
"key": "401f7ac837da42b97f613d789819ff93537bee6a",
"environment": "zapier",
"expiry": 365,
"created_by": {
"id": 1042,
"full_name": "Jordan Lee",
"email": "jordan@example.com"
},
"created": "2026-08-16T09:12:33.512000Z",
"expiry_date": "2027-08-16T09:12:33.512000Z",
"expired": false,
"usage_count": 0
}
Management API — Tokens & Usage
Create an API token
POST /console/token/
POST
/
console
/
token
/
curl -X POST "https://qcg-api.scanova.io/console/token/" \
-H "Authorization: Bearer <your_oauth_access_token>" \
-H "Content-Type: application/json" \
-d '{
"name": "Zapier — production",
"environment": "zapier",
"expiry": 365
}'
{
"name": "Zapier — production",
"key": "401f7ac837da42b97f613d789819ff93537bee6a",
"environment": "zapier",
"expiry": 365,
"created_by": {
"id": 1042,
"full_name": "Jordan Lee",
"email": "jordan@example.com"
},
"created": "2026-08-16T09:12:33.512000Z",
"expiry_date": "2027-08-16T09:12:33.512000Z",
"expired": false,
"usage_count": 0
}
Creates a new Management API key. This endpoint lives on the regular Scanova API host (
qcg-api.scanova.io) and is authenticated the same way as any other logged-in dashboard request — an OAuth access token, not a Management API key.
This is the one Management API–related call you make from a trusted context using your own login, not from the integration that will use the resulting key. See the overview for the full two-host architecture.
Request
POST https://qcg-api.scanova.io/console/token/
Authorization: Bearer <your_oauth_access_token>
Content-Type: application/json
Body parameters
string
required
A human-readable label for the key, e.g.
"Zapier — production". Shown in the dashboard’s key list so you can tell keys apart.string
default:"sandbox"
One of
sandbox, live, zapier, mcp. Permanent for the life of the key — determines which plan quota is checked on every data-host request the key makes, and for zapier/mcp keys, which User-Agent header the calling client must send. See Plan quota for the full mapping.integer
default:"-1"
One of
-1 (Never), 30, 90, or 365 — days after creation the key stops working. There is no way to extend an existing key’s expiry; create a new one instead.curl -X POST "https://qcg-api.scanova.io/console/token/" \
-H "Authorization: Bearer <your_oauth_access_token>" \
-H "Content-Type: application/json" \
-d '{
"name": "Zapier — production",
"environment": "zapier",
"expiry": 365
}'
{
"name": "Zapier — production",
"key": "401f7ac837da42b97f613d789819ff93537bee6a",
"environment": "zapier",
"expiry": 365,
"created_by": {
"id": 1042,
"full_name": "Jordan Lee",
"email": "jordan@example.com"
},
"created": "2026-08-16T09:12:33.512000Z",
"expiry_date": "2027-08-16T09:12:33.512000Z",
"expired": false,
"usage_count": 0
}
Response fields
string
The raw Management API key. This is the only response that ever returns the full key value — there is no reveal/retrieve-later endpoint, so store it immediately.
string | null
The absolute expiry timestamp computed from
created + expiry days, or null when expiry is -1 (Never).boolean
Whether the key has already passed its
expiry_date. Expired keys fail authentication on the data host but aren’t automatically deleted — remove them explicitly via DELETE /console/token/{key}/ if you want them off the list.integer
Lifetime count of requests made with this specific key, across its entire history. This is different from the aggregate, environment-wide figures returned by the usage endpoints below, which sum across every key sharing that environment.
Listing existing tokens
The sameconsole/token/ path also accepts GET (no body) to list every key on the account, returning the same shape as the create response for each. You can filter by environment: GET /console/token/?environment=live.
Both creating and listing tokens re-check plan quota using the request’s
environment — the body field on create, the query parameter on list, defaulting to sandbox if omitted. If your plan’s sandbox and live quotas differ, pass ?environment=live explicitly when listing live-environment keys, since the default otherwise checks the sandbox quota.Related
- Management API overview — the two-host architecture and per-
environmentquota mapping this endpoint’senvironmentfield feeds into. - Remove an API token — revoke a key created here.
- Usage statistics — aggregate request counts for keys sharing an environment.
- List / create QR codes — the first data endpoint most integrations call with a key created here.
Authorizations
Send your Management API key as the raw value of the Authorization header — no "Bearer " or "Token " prefix, and no other characters. Example: Authorization: 401f7ac837da42b97f613d789819ff93537bee6a. A header containing more than one space-separated part is rejected outright. Requests also require the request's Host header to be the management API host (e.g. management.scanova.io) — the same key sent to the regular API host will not authenticate.
Response
201
Token created
Was this page helpful?
⌘I