Barcode and QR code API

Who it is for

The API comes with the Business plan (10,000 calls a month) and the Pro plan (100,000 calls a month). Keys are made in the panel, on its API page.

Address and key

Every route is under https://app.qreska.com/api/v1. Each call carries the key in a header, never in the address, because addresses end up in logs and browser history. Do not put the key in page code that reaches a browser: the API is for your server.

An API key from the panel, in the Authorization: Bearer qrk_… header

Every route described in OpenAPI 3.1, for Postman, Insomnia or a client generator: https://app.qreska.com/api/v1/openapi.json

Limits

• The plan's monthly allowance is counted per calendar month (UTC). Every call with a valid key counts, including those that fail validation; calls refused for a missing key or the limit do not.
• Up to 20 calls a second per team. Beyond that the answer is 429 with a Retry-After header.
• Every answer has RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers (seconds until the next month begins).

What we keep

The content of static codes is drawn in memory and forgotten once the answer is sent. The call log you see in the panel has the time, key, method, route without data, result and response time — no content and no IP address. Details in the privacy policy.

Examples

An EAN-13 as PNG at 600 dpi:

curl -X POST https://app.qreska.com/api/v1/barcodes \
  -H "Authorization: Bearer $QRESKA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"symbology":"ean-13","data":"590123412345","format":"png","dpi":600}' \
  -o ean-13.png

A dynamic code, then a change of its target:

curl -X POST https://app.qreska.com/api/v1/codes \
  -H "Authorization: Bearer $QRESKA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name":"Flyer","target":{"type":"url","url":"https://example.com/offer"}}'

curl -X PATCH https://app.qreska.com/api/v1/codes/$CODE_ID \
  -H "Authorization: Bearer $QRESKA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target":{"type":"url","url":"https://example.com/winter"}}'

SDKs for JavaScript and PHP

Two small libraries without dependencies: for Node.js 18+ (TypeScript, fetch) and for PHP 8.1+ (curl). They handle the key, errors as exceptions carrying the code from the table above, a retry after 429 rate_limited, and paging through the list of codes. Until they are published on npm and Packagist they install from the sdk/js and sdk/php folders of the repository.

JavaScript and TypeScript:

import { Qreska } from "@qreska/sdk";

const qreska = new Qreska({ apiKey: process.env.QRESKA_KEY });
const file = await qreska.barcode({ symbology: "ean-13", data: "590123412345", format: "png" });
const code = await qreska.codes.create({
  name: "Flyer",
  target: { type: "url", url: "https://example.com/offer" },
});

PHP:

$qreska = new \Qreska\Client(getenv('QRESKA_KEY'));
$file = $qreska->barcode(['symbology' => 'ean-13', 'data' => '590123412345', 'format' => 'png']);
file_put_contents('ean-13.png', $file->data);
$code = $qreska->createCode([
    'name' => 'Flyer',
    'target' => ['type' => 'url', 'url' => 'https://example.com/offer'],
]);

GTIN, ISBN and ISSN numbers

GTIN/EAN numbers are issued by GS1 (in Poland: GS1 Polska). Qreska only draws the code from a number you already have.

ISBNs are issued by the national ISBN agency (in Poland: the ISBN office of the National Library). Qreska only draws the code from a number you already have.

ISSNs are issued by the national ISSN centre (in Poland: the ISSN centre of the National Library). Qreska only draws the code from a number you already have.

Errors

Errors come as application/problem+json (RFC 9457). The code field is fixed, for programs to compare; title is for people, in Polish or English after the Accept-Language header. On validation errors, errors names the fields: path is the place in the request body, code is the reason.