# QA.tech API authentication

Machine-readable summary of how automated clients authenticate with QA.tech.
Human docs: https://docs.qa.tech/api-reference/introduction

## Hosts

- API base URL: `https://api.qa.tech/v1`
- MCP endpoint: `https://api.qa.tech/v1/mcp` (streamable HTTP, JSON-RPC 2.0, stateless)
- Marketing site (this origin): `https://qa.tech` – no tokens are issued here.

## Supported methods

### 1. Bearer API keys (recommended for servers and CI)

```
Authorization: Bearer <QA_TECH_API_KEY>
```

- Created in the QA.tech app under Organization Settings -> API Keys.
- Keys are scoped read-only or read-write at creation time.
- The same key works for the REST API and for the MCP endpoint.
- Send it on every request; there is no session or cookie flow for the API.

### 2. OAuth sign-in (recommended for interactive MCP clients)

Interactive clients such as Claude Code, Cursor and Codex can connect to
`https://api.qa.tech/v1/mcp` and complete an in-browser sign-in on first
connect. No key needs to be pasted into the client config.

Authorization-server metadata (RFC 8414 / RFC 9728) is published by the API
host, not by this marketing origin. If you need it programmatically, query
`https://api.qa.tech` – do not assume `https://qa.tech/.well-known/oauth-authorization-server`.

## Errors

All QA.tech endpoints return JSON errors with a stable machine-readable shape:

```json
{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid API key.",
    "hint": "Create a key in Organization Settings -> API Keys and send it as an Authorization: Bearer header.",
    "docs": "https://docs.qa.tech/api-reference/introduction"
  }
}
```

## Related discovery documents

- API catalog (RFC 9727): https://qa.tech/.well-known/api-catalog
- MCP server card: https://qa.tech/.well-known/mcp/server-card.json
- Agent skills: https://qa.tech/.well-known/agent-skills.json
- Site index for LLMs: https://qa.tech/llms.txt
- Developer hub: https://qa.tech/developers
- OpenAPI document: https://docs.qa.tech/api-reference/api.json
- Webhooks: https://docs.qa.tech/integrations/webhooks

Contact: support@qa.tech