API keys are how programmatic clients — the REST API, the qcoscloud SDK and CLI, CI pipelines and MCP tools — authenticate to the platform. A key authenticates as its owning user with the same workspace scoping as a console session.

​
Create a key

1

Open API Keys

Sign in at platform.softquantus.com and open API Keys in the sidebar.
2

Name it and pick scopes

Give the key a descriptive label (for example ci-pipeline) and tick only the permission scopes it needs (see Scopes).
3

Copy it once

The full key — sq-live- followed by 48 hex characters — is shown exactly once at creation. Store it in a secret manager. Afterwards the console only ever shows the key’s prefix.

​
Use the key

Send it as a bearer token on every request to https://platform.softquantus.com:
The SDK and CLI read the same key from the QCOSCLOUD_API_KEY environment variable. Every use updates the key’s Last used timestamp in the console, so you can spot stale or unexpectedly active keys.

​
Scopes

Grant the least privilege each key needs. These are the scopes offered in the console: For a dashboard use qcos:read; for a job runner use qcos:execute.

​
Revoke or delete a key

In the console, each key row offers:
  • Revoke — the key stays listed (status revoked) but stops authenticating from the next request onward. Use this the moment a key may have leaked.
  • Delete — removes the key entirely.
To rotate a key: create a new key, move your workloads to it, then revoke and delete the old one.

​
Security notes

  • Treat the key as a password. It runs workloads and spends the workspace’s prepaid credits as you.
  • Keys are stored server-side only as a SHA-256 hash; a lost key cannot be recovered, only replaced.
  • Never commit keys to source control. Prefer environment variables or a secret manager, and one key per integration so revocation is surgical.
  • API requests are rate limited per IP (60 requests/minute by default); expect 429 with a rate_limit_exceeded code if you exceed it — see Errors.

​
API key management over REST