Voznest Forge

Workspace

WorkspaceProjects

Development

DocsAPI ReferenceSDKsEmbed StudioChangelog
  1. Forge
  2. /Docs

Start here

Getting StartedQuickstartPlatform ConceptsEnvironments

Build

ProjectsIdentityAgentsGatewayCapabilitiesPermissions ReferenceInstallationsLive activity

Commands & interactions

CommandsContext-menu CommandsInteractionsComponentsModals (Forms)Activities (Embedded Apps)

Acting in hubs

MessagesEmbedsEmbeds v2 (Blocks)Embeds v3Incoming WebhooksHub Management APIEvent StreamDelivery

Sign in with Voznest

AccessOpenID Connect

API

APIAuthenticationErrorsRate LimitsSecurity

Publish & operate

App Market & ListingTemplates & SandboxObservability & Team Tools

Tools

SDKsExamplesFAQ & TroubleshootingReference

API

Authentication

Which credential goes where.

CredentialHeaderUse it for
Agent token (qag_)Authorization: Bot …Everything the agent does in hubs, the gateway, interactions
API key (qak_)Authorization: Key …Automation on /projects/@self: commands, telemetry, activity — limited by scopes and an optional IP allowlist
OAuth access token (qat_)Authorization: Bearer …Only /oauth/@me endpoints, as the person who authorized
Client secret (qcs_)body or HTTP BasicOnly /oauth/token and /oauth/revoke

API key scopes: project.read, commands.read, commands.write, telemetry.read, activity.read. Keys can expire; client secrets and keys can be rotated with a grace period during which the old value still works.

bash
# Publish the command list from CI with an API key (scope: commands.write)curl -X PUT "https://api.voznest.com/api/v1/projects/@self/commands" \  -H "Authorization: Key $VOZNEST_API_KEY" \  -H "Content-Type: application/json" \  --data @commands.json
Never put a token, key or secret in client-side code, a repository or a URL. If one leaks, rotate it in Secrets — the rotation is immediate and recorded in Audit.
PreviousAPINext Errors