API Authentication

Every protected QCOS endpoint expects a bearer token in the Authorization header.

curl "$QCOS_API_URL/user/me" \
  -H "Authorization: Bearer $QCOS_API_KEY"

Headers

Header	Required	Value
`Authorization`	Yes	`Bearer sq-live-...` (alternatively `X-API-Key: sq-live-...`)
`Content-Type`	For JSON bodies	`application/json`
`Idempotency-Key`	Recommended for submissions	Unique request key

Environments

export QCOS_API_URL="https://api.softquantus.com"
export QCOS_API_KEY="sq-live-your-key"

Keys are created in the SoftQuantus Platform console (platform.softquantus.com → API Keys). QCOS scopes: qcos:read (list backends, jobs, evidence) and qcos:execute (submit jobs).

Security rules

Use scoped keys for services and CI/CD.
Avoid shared personal keys in production.
Rotate keys through the portal.
Keep QuantumLock license keys separate from API keys.
For partner integrations, use a dedicated tenant and budget.

​API Authentication

​Headers

​Environments

​Security rules

API Authentication

Headers

Environments

Security rules