QuantumAPI

Quick start

Store your first secret and read it from a script, the CLI or an SDK in about five minutes.

Created: September 23, 2026 Updated: September 24, 2026 Platform v0.21.3

In this quick start you will save a database connection string as a secret, create an API key and read the secret back from code. You only need a QuantumAPI account; if you don't have one yet, sign up at portal.quantumapi.eu.

You don't need to create an encryption key first: your organisation gets a default ML-KEM-768 key (the NIST FIPS 203 post-quantum key-encapsulation standard) automatically. Your secrets are encrypted with AES-256-GCM under a key protected by ML-KEM.

1. Store your first secret

1

Open the vault

Choose Vault in the navigation rail. You land on Secrets Vault.

Empty Secrets Vault
2

Create the secret

Click Create Secret and fill in at least Name and Value. Choose a Content Type (for example Connection String) so the portal can check and display it properly. Labels, notes, URLs, custom fields and a TOTP seed are optional. Click Create.

Create New Secret dialog
3

Open it

The secret appears in the list. Click it to see its details; values stay hidden until you click Click to reveal secret value. Every reveal is recorded in the audit log.

Secret detail with the value revealed

2. Create an API key

1

Open Keys → API Keys

Click Create API Key, give it a name (for example quickstart) and enable only the Secrets Read scope. Click Create.

Create API Key form
If you leave every scope unselected, the key gets all permissions. Always pick the scopes the application needs.
2

Copy the key

The full key is shown only once. Copy it now and keep it in an environment variable. The portal also saves a copy in your vault automatically, unless you ticked Don't save to vault.

API key created banner
Terminal
# Interactive: opens the browser to sign in
qapi login

# CI / scripts: use an API key instead
export QAPI_API_KEY=qapi_xxx

3. Read the secret from code

Copy the secret ID from its detail page (just under the name), then use any of these options:

cURL
curl https://api.quantumapi.eu/api/v1/secrets/<secret-id> \
  -H "X-Api-Key: $QAPI_API_KEY"
Response
{
  "id": "5f0c1c3e-8a4b-4d3e-9a51-2b7c0d9e1f42",
  "name": "prod-postgres",
  "value": "postgresql://app:••••@db.acme.internal:5432/orders",
  "version": 1,
  "contentType": "connection-string"
}
qapi CLI
# Create a secret
qapi secrets create prod-postgres "postgresql://app:••••@db.acme.internal:5432/orders" \
  --content-type connection-string --label env=prod --folder Production

# Find its ID
qapi secrets list

# Read the raw value (ideal for scripts)
export DATABASE_URL=$(qapi secrets get <secret-id> --value)
TypeScript (npm install @quantumapi/sdk)
import { QuantumAPIClient } from '@quantumapi/sdk'

const client = new QuantumAPIClient({ apiKey: process.env.QAPI_API_KEY! })

const secret = await client.secrets.get('<secret-id>')
console.log(secret.name, secret.value)
Python (pip install quantumapi)
from quantumapi import QuantumAPISyncClient
import os

client = QuantumAPISyncClient(api_key=os.environ["QAPI_API_KEY"])

secret = client.secrets.get("<secret-id>")
print(secret.name, secret.value)

What you have done

  • Stored a secret, encrypted at rest and versioned.
  • Created an API key with the minimum scope and read the secret from code.

Keep going

Complete QuantumVault tutorial

Folders, versions, sharing, rotation, dynamic secrets, SSH and PKI.

qapi CLI

Install the CLI and use it in scripts and pipelines.

qapi — QuantumAPI CLI Documentation