Authorization

The Sitequest API uses Bearer token authentication with API keys.

API Keys

Create API keys in your Dashboard under API / MCP (open the profile menu at the bottom of the sidebar). Each key can be configured with a name, expiry date, and specific permission scopes.

Include your key in every request via the Authorization header:

Authorization: Bearer sq_live_xxxxx...

API keys use the prefix sq_live_ followed by a 64-character hex string.

Scopes

Each API key is assigned one or more scopes that control what it can access. Use the principle of least privilege — only grant the scopes your integration needs.

When creating a key you can choose Full access (all scopes), Read only (vps:read + domains:read + webspace:read), or Custom (pick individual scopes).

Resource Restrictions

In addition to scopes, an API key can be restricted to specific VPS instances, domains, and/or webspaces. When Resource restrictions are enabled, only the explicitly allowed resource IDs can be accessed by the key — even if the scope would otherwise permit them. Newly provisioned resources are not auto-added; grant access by editing the key.

Rate Limiting

API requests are rate-limited to 60 requests per minute per API key.

Every response includes rate limit headers:

When the rate limit is exceeded the API returns 429 Too Many Requests.

Error Responses

Authentication errors return a JSON body:

{
  "error": "Invalid or missing API key",
  "code": "UNAUTHORIZED",
  "status": 401
}

Security Tips

• Never commit API keys to version control.
• Rotate keys regularly and revoke unused ones.
• Use the narrowest scopes possible.
• Set an expiry date for keys used in CI/CD pipelines.