QRARC 2.0Advanced Dynamic Architecture is now live.→
Back to Help Center

Developer API

API keys, rate limits, webhooks, and integrating QR generation into your app.

Getting Your API Key

To start using the QRARC API, you will need to generate a secure API key.

  1. Go to Settings > Developer Hub.
  2. Click the Generate New Key button.
  3. Copy the key immediately. For security reasons, it will never be shown to you again.

Rate Limits

Our API is built for scale, but to prevent abuse, we enforce rate limits based on your subscription tier.

// Pro Plan: 100 req/min
// Enterprise Plan: 1,000+ req/min

Webhooks

Instead of constantly polling the API to see if a QR code was scanned, you can set up Webhooks. We will send a secure POST request to your designated endpoint the exact millisecond a code is scanned, containing the device and location payload.

Frequently Asked Questions

Our full REST API documentation, including endpoints, payloads, and code examples, is available in the Developer Hub section of your dashboard.

Authentication is handled via Bearer Tokens. You must include your secret API key in the Authorization header of every request.

Navigate to Settings > Developer Hub, and click "Generate New Key". For security, the key will only be shown to you once.

Pro plans are limited to 100 requests per minute. Enterprise plans start at 1,000 requests per minute and can be scaled infinitely based on your contract.

Yes. You can programmatically generate dynamic codes, retrieve the high-res image buffers, and instantly update the destination URLs.

Yes. Static generation endpoints are completely free to use and do not count against your dynamic code limits.

Yes. You can register webhook endpoints in the Developer Hub. We will send a POST payload in real-time whenever one of your codes is scanned.

You can request the API to return the QR code image as a base64 string, an SVG string, or a direct binary buffer.

Yes. You can pass a `template_id` parameter in your API request to automatically apply complex branding rules to the generated code.

Currently, all API keys operate in production. We recommend creating a separate workspace if you wish to run isolated tests.

We currently maintain official SDKs for Node.js/TypeScript, Python, and Go.

Yes, all API requests must be made over HTTPS. HTTP requests will be strictly rejected.

If you exceed the limit, the API returns a 429 status code. You should implement exponential backoff in your code to retry the request.

Yes. There are specific endpoints to retrieve time-series scan data, geographic breakdowns, and device metrics.

Please contact our developer support team directly at developers@qrarc.com with your request payload and response headers.