Authentication

Managing your own polls, quizzes, and forms requires an API key. Letting your end-users respond to them does not.

Managing your resources

Creating, reading, updating, deleting, and reading results for your own polls, quizzes, and forms requires an API key on every request, sent as an X-API-Key header:

curl -H "X-API-Key: qna_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" \
  https://qnaapi.com/api/v1/polls

An account can have multiple keys (see API Keys) — any of them authenticates you as that account. They're not scoped to particular polls/quizzes/forms by default; every key can manage everything on the account unless it's assigned to a site.

Requests without a valid key return 401 Unauthorized:

{ "message": "Invalid or missing API key." }

Public endpoints — no key required

Casting a vote, submitting a quiz attempt, and submitting a form are the exceptions — none of them require an API key, since real voters/quiz-takers/respondents are your end-users, not you. All three are public, rate-limited (30 requests/minute/IP) endpoints meant to be called directly from your end-users' own browser or app — no backend proxy needed.

• POST /polls/{poll}/votes — see Votes
• POST /quizzes/{quiz}/attempts — see Quiz Attempts
• POST /forms/{form}/submissions — see Form Submissions

Everything else — creating/managing polls/quizzes/forms, and reading votes/attempts/submissions back — still requires your key.