Authentication

Token-based authentication: creating an API token and using the Quick-Company-Id header.

Every QUiCK API call is authenticated. Authentication is API token based: the token travels in the Authorization header on every request, prefixed with Token.

Using the token

GET /1/partners/ HTTP/1.1
Host: api.quick.zenheads.hu
Authorization: Token XXXXXXXX.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Accept: application/json

If the header is missing or the token is invalid, the response is 401 Unauthorized. If the token is valid but lacks permission for the company or the operation, the response is 403 Forbidden.

Identifying your application — X-Application

If your integration has a name (e.g. a webshop, an accounting tool, a BI system), send it in the optional X-Application header on every request:

GET /1/partners/ HTTP/1.1
Host: api.quick.zenheads.hu
Authorization: Token XXXXXXXX.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X-Application: my-integration-name

It is not used for authentication or authorization and has no effect on the response — it only helps us tell which application is calling the API when we look into an issue or a usage pattern. There is no fixed list of values; any short, stable name identifying your integration is fine.

Company scope — Quick-Company-Id

Some /2/ endpoints accept an optional Quick-Company-Id header that selects the target company explicitly:

GET /2/expense-types/ HTTP/1.1
Host: api.quick.zenheads.hu
Authorization: Token XXXXXXXX.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Quick-Company-Id: 4821

• If you omit it, the company is inferred from the token — this is the usual case.
• If you send it and it does not match the token's company, the response is 403 Forbidden.

Your company id is returned by GET /2/company-info/ (see below).

Creating an API token

Tokens are created in the QUiCK app, under company settings. The Administrator role is required.

1. Sign in to the QUiCK app, then click the company name in the top right to open the company switcher.
2. In the My companies list, click the gear icon next to the company — this opens its settings.
3. Scroll to the API Tokens section and click Create new API token.
4. Give the token a descriptive name reflecting where you use it (for example „Webshop sync" or „Power BI report").
5. Click Create.
6. The token is shown only once, at creation time. Click Copy token and store it somewhere safe.

Reading company information

With a token in hand, GET /2/company-info/ returns the base data of the token's company — including the id you may need for the Quick-Company-Id header.

curl https://api.quick.zenheads.hu/2/company-info/ \
  -H "Authorization: Token $QUICK_API_TOKEN"

{
  "id": 4821,
  "name": "Riport Applications Kft.",
  "tax_account_number": "12345678-2-42",
  "default_currency_name": "HUF",
  "expense_email": "expenses@example.com",
  "document_email": "documents@example.com",
  "advanced_accounting": true,
  "enable_accounting_id": true,
  "enable_vat_period": true
}

Storing the API token

Pick the store that matches your environment — the token must never reach version control or a client-side bundle.

• Local development: a .env file listed in .gitignore, loaded with dotenv
• Server (VPS, container): an environment variable at the service-manager level (systemd, Docker)
• CI/CD: a secret variable (GitHub Actions secret, GitLab CI variable)
• Managed platform: the native secret store (AWS Secrets Manager, Vercel env, Cloudflare secrets)

export QUICK_API_TOKEN="XXXXXXXX.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

Working with multiple companies

If your integration serves several companies, create a separate token per company (each in that company's settings). You route calls to the right company by selecting the matching token; the Quick-Company-Id header is only needed when you want to bind a request to a specific company explicitly and have the API verify it.