# qrvote auth.md

How AI agents and other software authenticate with qrvote (https://qrvote.org).

## Who this is for

Agents acting **on behalf of an organizer** who runs a contest, survey or
scavenger hunt on qrvote, for example to read results, change settings, add
entries or export a CSV.

## Registration

There is none. qrvote has no accounts, no OAuth and no agent registration
endpoint, so there is nothing for an agent to sign up for.

## Credentials

Each contest, survey or hunt has exactly one **organizer key**. A person
creates the contest in a browser (creation needs a human check) and gets a
private organizer link:

    https://qrvote.org/c/<slug>/admin#key=<organizer key>

The organizer can hand that key to an agent. Send it on every request as a
bearer token:

    Authorization: Bearer <organizer key>

The key controls only that one contest, survey or hunt, and grants everything
the dashboard can do, including deleting it. Treat it like a password. It
can't be recovered or rotated, so if it leaks the organizer should delete the
contest and start a new one.

## What's available

- Public, no key: `GET /api/c/{slug}` and, when results are public,
  `GET /api/c/{slug}/results`.
- With the organizer key: the `/api/admin/{slug}` endpoints.

Full description: https://qrvote.org/openapi.json (OpenAPI 3.1), with a
readable guide at https://qrvote.org/developers.

## Not available to agents

Creating contests, voting, answering surveys, collecting hunt checkpoints and
sending reports are for people in a browser. They need a Cloudflare Turnstile
check and refuse automated clients. Please don't try to work around that;
it's how votes stay fair.

## Contact

legal@qrvote.org