Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.qoder.com/llms.txt

Use this file to discover all available pages before exploring further.

The Qoder Cloud Agents API uses Personal Access Tokens (PATs) for authentication. Every API request must include a valid PAT in the HTTP headers.

​
Obtaining a PAT

  1. Sign in to the Qoder console.
  2. Open Settings → API Tokens.
  3. Click Create token and configure the name and scopes.
  4. Copy the generated token. The full value is shown only once—store it securely.
PATs are prefixed with pt-, e.g. pt-your-token-here. Never commit tokens to source control or share them publicly.

​
Bearer header format

Pass the PAT in the Authorization header of every request as a bearer token: 
Authorization: Bearer pt-your-token-here

​
Full request example

# List Agents
curl -s https://openapi.qoder.sh/api/v1/cloud/agents \
  -H "Authorization: Bearer $QODER_PAT"
Store the PAT as an environment variable to avoid hard-coding: 
# Add to ~/.bashrc or ~/.zshrc
export QODER_PAT="pt-your-token-here"

# Verify the configuration
curl -s https://openapi.qoder.sh/api/v1/cloud/agents?limit=1 \
  -H "Authorization: Bearer $QODER_PAT"

​
Difference from x-api-key

MethodHeader formatWhen to use
Bearer TokenAuthorization: Bearer <PAT>Recommended. Used for all Cloud Agents API calls.
x-api-keyx-api-key: <key>Legacy or third-party integrations. Not supported by the Cloud Agents API.
The Cloud Agents API only accepts Authorization: Bearer. Requests using x-api-key return 401 authentication_error.

​
Troubleshooting authentication failures

​
Common errors

HTTP statusError typeLikely cause
401authentication_errorPAT is invalid, expired, or malformed
403permission_errorPAT is valid but lacks access to the target resource

​
401 error response example

{
  "type": "error",
  "error": {
    "type": "authentication_error",
    "message": "Invalid API key or token."
  }
}

​
Troubleshooting steps

  1. Confirm the PAT has not expired or been revoked.
  2. Check that the request uses Authorization: Bearer, not x-api-key.
  3. Verify the Bearer prefix is spelled correctly (case and spacing).
  4. Confirm the environment variable is exported.
# Quick check: print the first few characters of the PAT
echo "${QODER_PAT:0:8}..."

​
Security recommendations

  • Use separate PATs for development, staging, and production.
  • Rotate tokens regularly.
  • Apply least-privilege scopes when issuing tokens.
  • Revoke any leaked token immediately from the console.