API authentication

1. Create your form read key

As the form owner, open the form in your dashboard, choose Settings, then API & routing, and find the Read API panel. Select Rotate read key to create a credential. Copy the new key immediately: it is shown once. The key begins with cf_read_ and grants access to submissions for this form only. Create a separate key for each form your integration needs to read.

2. Store the key on your server

Save the key in a private server environment variable or secret store. The examples use QUBEFORMS_READ_KEY as an environment variable in your own integration. Anyone holding this key can read the associated form, including its submitted fields and attachment links. Keep it out of browser JavaScript, public repositories, URLs, and logs. Your public cf_pk_ form key cannot authorize read requests.

3. Send a bearer header

Set QUBEFORMS_READ_KEY in your server environment before running this example. Send the key with every request using Authorization: Bearer followed by the complete key. A dashboard login cookie or public form key does not replace this header. The read key selects the form, so there is no form ID parameter on the list endpoint.

curl --fail-with-body \
  'https://api.qubeforms.io/v1/read/submissions?limit=10' \
  --header "Authorization: Bearer ${QUBEFORMS_READ_KEY}" \
  --header 'Accept: application/json'

4. Rotate a lost or exposed key

Return to Settings and select Rotate read key. This immediately revokes every older read key for that form. Replace the key in all integrations that use the form; requests using an older key will return 401. There is no overlap period, so coordinate the update with any running jobs. Rotating a read key leaves the public submission endpoint unchanged.

5. Resolve authentication failures

A missing, malformed, invalid, or revoked key returns HTTP 401. Check that the header contains Bearer, one space, and the full current cf_read_ key. Do not substitute an account password or a management credential. Read keys cannot change form settings or read another form.

{
  "ok": false,
  "error": {
    "message": "Read API key is invalid or revoked.",
    "details": []
  }
}

6. Verify access after setup

Request a small list page, then retrieve one returned submission ID using the same key. Confirm the fields belong to the intended form. After rotation, check that the new key works and the previous key fails. A teammate’s dashboard role does not scope a copied read key; keep your integration’s own authorization checks in place before serving data.

• List submissions
• Get a submission
• Account security