Create API tokens
Issue a company token for pipelines, scripts, and coding agents. The plaintext secret is shown once.
Role: Company admin · Screen: Company Setup → API tokens · Time: a few minutes
Machine callers use Authorization: Bearer qsk_… against /api/v1. Interactive Sign In JWTs are for people in the console, not for CI or a coding agent. Call the quemsi CLI (--wait is the default) or curl.
Before you start
- You can open Company Setup for the company that owns the agent and data.
- Know which agent the caller will use. Bind a laptop token to your local agent; bind a CI token to the pipeline agent. A bound token cannot snapshot or restore on another agent.
- Have a place to store the secret (GitHub Actions, Jenkins, or your shell profile / Cursor env). Do not commit the token.
Steps
Create a token
Give it a name your team will recognize (for example ci-staging or cursor-local). Choose scopes:
snapshot—POST /api/v1/snapshotsrestore—POST /api/v1/restoresread—GET /api/v1/executions/{id}andGET /api/v1/restore-actions
Default is all three. A restore-before-tests job needs restore and read. A snapshot-before-deploy job, or a laptop coding agent, needs snapshot and read — omit restore on the laptop token so the agent cannot overwrite the database.
Optionally bind one agent
If you bind the token to an agent, every snapshot and restore must use that agent’s name in the JSON body. Calls for another agent return forbidden (token-agent-mismatch). For a coding agent on your laptop, bind the token to that local agent.
Copy the secret once
The value starts with qsk_ and is shown only at create time. Quemsi stores a SHA-256 hash, not the plaintext. If you close the dialog without copying, create another token and revoke the unused one.
Store the secret
Typical names: QUEMSI_TOKEN and QUEMSI_URL (for example https://quemsi.com). CI: a credentials store. Laptop: shell profile or Cursor env. Revoke the token from the same page if it leaks or the caller is retired.
Issue a company token
Create it in Company Setup, copy it once, then keep it in CI or as QUEMSI_TOKEN on the laptop.