Authentication

API key authentication

For CI/CD and programmatic access, use an API key in the X-API-Key header:

X-API-Key: your-api-key-here

API keys are scoped to a specific project and organization. Create them from Settings > API Keys in your project.

See API keys for creation and management details.

Bearer token authentication

For programmatic access to dashboard API routes, you can use a Firebase ID token as a Bearer token:

Authorization: Bearer <firebase-id-token>

When the authenticated user belongs to multiple organizations, include the X-Org-Id header to select the target organization:

X-Org-Id: org_abc123

Session authentication

The VisualQ dashboard uses Firebase Authentication with session cookies. This is handled automatically by the browser and is not intended for programmatic use.

Error responses

All error responses follow this format:

{
  "error": "Description of what went wrong"
}