API reference

Send the session cookie, or an API token in the X-QAACK-TOKEN header. A missing or rejected token returns 401.

Webhooks, account activation, and social login do not use that token. Creating or deleting an API token needs the session cookie.