API key scope
Create keys under Configuration → Access. A workspace key can call any eligible endpoint in that workspace. An endpoint key can call only the selected endpoint. Prefer endpoint-scoped keys for a single application, partner, or automation.
Qry shows the full key only once. Store it in the consumer’s secret manager; after the page is reloaded, Qry retains only a hash and display prefix. Revoke keys when a consumer is removed or a credential may have leaked. Expiration and revocation are enforced before a request reaches the serving snapshot.
Separate trust boundaries
- Qry API keys authenticate downstream callers; they do not grant warehouse access.
- Warehouse credentials are used during controlled refreshes and should be read-only and schema-scoped.
- Workspace membership controls who can author endpoints and manage access.
- Public requests read verified snapshots and do not execute warehouse SQL.
Never put a warehouse credential in frontend code, an endpoint URL, a query parameter, or a public API key.