Authentication

Every request to the API carries one credential as a bearer token:

Authorization: Bearer <credential>

There are three kinds, for three situations. An API key is for code. A Connect with Quorum token is for an MCP client acting as a person. A playground token is what the documentation pages use on your behalf. All three resolve to a workspace, a set of services they may reach, a pair of limits, and a name for the usage pages.

API keys

An API key is for software that cannot sign in: a server, a pipeline, an agent running unattended.

Creating one. A workspace owner or admin opens the API keys page on the developer dashboard, names the key, picks the services it may reach, and sets its limits. The key is shown once and never stored by Quorum, so copy it into your secret store at that moment. Keys become available the moment the workspace has credits: starting credits, a credit pack, a plan, or a contract.

What a key is. An RS256 JWT signed by the Quorum accounts service. It names your workspace, the services it may reach (scopes), and a label. It has no expiry: a key lives until it is revoked from the dashboard.

Scopes are fixed. The services a key may reach are signed into it and cannot be changed afterwards. A key that needs more later is a new key, and the old one is revoked on purpose, so a widening of access is always a visible event rather than a silent edit. A workspace with every service may create a key scoped to *, which reaches services added later without re-issuing.

Limits can change. Requests per minute and claims per day live in the registry, not in the key, so an admin can raise or lower them at any time from the API keys page, up to the workspace's plan.

How a key is checked. On every request the gateway verifies the signature, checks that the key was issued by this dashboard and not revoked, checks the scope for the service, applies the limits, then checks the workspace's entitlement and credits. A perfectly signed key the dashboard never issued is refused.

Keeping it safe. Send a key only over HTTPS and only to api.quorumtech.ch. Never put it in a browser page or a mobile app, where anyone can read it. If a key leaks, revoke it from the dashboard: anything using it stops at once, and its past usage keeps its name.

Connect with Quorum (MCP clients)

An MCP client that supports OAuth, such as Claude or ChatGPT, never sees a key. Add https://api.quorumtech.ch/attest/mcp as a connector and the client sends you to the developer dashboard to approve the connection with your Quorum account. From then on it acts as you, with your workspace's default limits, and appears under Connected clients on the MCP servers page, where you or an admin can disconnect it.

Any member of an entitled workspace can connect. A workspace without credits is refused at the consent step with a message naming the Billing page. A client that cannot sign in can use an API key as its bearer token instead.

The playground on these pages

The "Try it" panel on every endpoint page sends a real request as the person signed in. The documentation page holds a key of its own on its server and asks the API for a short-lived playground token beside your session, so you never need a key of yours to try a call. The request is charged to your workspace like any other and appears in usage as "API reference". See Using the documentation.

What is refused where

| Credential | Dashboard pages | API routes (/attest/...) | | --- | --- | --- | | Quorum session token | yes | no | | API key | no | yes | | Connect with Quorum token | no | yes | | Playground token | no | HTTP routes only, never MCP |

A session token is never accepted on an API route and a key is never accepted on the dashboard. The two have different holders, lifetimes and revocation stories, and a token that worked in both places would be the more dangerous of the two.

Errors you will see

| Status | Code | Meaning | | --- | --- | --- | | 401 | unauthorized | The credential is missing, not recognised, revoked, or the wrong kind for this route. | | 403 | insufficient_scope | The key does not include this service. Create a key that does. | | 402 | payment_required | The workspace has no active API subscription or credits yet. The message names the Billing page. |