# quik.md API — Authentication

quik.md is a voice-first capture app with AI organize: you think out loud, and
quik files each thought into the right project with the next step already
written. The REST API lets agents capture items, manage projects and tags,
search, and export.

- Base URL: `https://quik.md/api/v1`
- OpenAPI spec: <https://quik.md/docs/api/openapi.json>
- Interactive docs: <https://quik.md/docs/api>

## Getting an API key

1. Sign up at <https://quik.md/sign-up>.
2. In the app, open **Settings → Developer** (<https://quik.md/settings/developer>).
3. Create a key. Keys are prefixed `qk_` and shown once — store it like a password.

## Authenticating

Send the key as a bearer token on every request:

```
Authorization: Bearer qk_...
```

Session cookies (signed-in browser) also work, but agents should use API keys.

## Rate limits

Enforced per user, per minute and per UTC day:

| Plan | Per minute | Per day |
| ---- | ---------- | ------- |
| Free | 60         | 1,000   |
| Pro  | 300        | 10,000  |

Over the limit you get `429` with a `retry_after` (seconds) in the body.

## Main resources

- `GET /api/v1/me` — whoami / auth check (also the catalog status endpoint)
- `POST /api/v1/capture` — capture a thought (text or audio)
- `GET|POST /api/v1/items`, `/api/v1/items/search`, `/api/v1/items/bulk`, `/api/v1/items/{id}`
- `GET|POST /api/v1/projects`
- `GET|POST /api/v1/tags`
- `POST /api/v1/voice` — audio capture
- `GET /api/v1/export` — export
- `/api/v1/webhooks` — outbound webhooks
- `/api/v1/connect/*` — unauthenticated agent pairing flow (no key needed)

Full request/response schemas are in the OpenAPI spec.

## Agent skills (SKILL.md)

Drop-in skill files for agent frameworks:

- Generic: <https://quik.md/docs/api/agents/generic/skill.md>
- Hermes (Telegram operator): <https://quik.md/docs/api/agents/hermes/skill.md>
- OpenClaw: <https://quik.md/docs/api/agents/openclaw/skill.md>