Step 1 · Get API access
API keys are included in the Label plan. Upgrade from the Account tab in the Studio, then reload — an API Keys section appears in your Account panel. Up to 5 active keys per account.
Step 2 · Create a key
In Account → API Keys, name your key (e.g. “catalog-sync”) and press Create key. The full key — starting with qm_live_ — is shown exactly once. Copy it into your secrets manager immediately: we store only a SHA-256 hash, so it can never be displayed again. Lost it? Revoke and create a new one.
Step 3 · Authenticate
Send the key on every request in the X-API-Key header (or as Authorization: Bearer qm_live_…):
curl -H "X-API-Key: qm_live_YOUR_KEY" https://www.quantaramusic.com/api/v1/me
A valid key returns your account summary as JSON. Requests are limited to 120/minute; keys can be revoked instantly from the Account panel and stop working immediately.
Step 4 · Endpoints (v1)
GET /api/v1/me — account, plan, storage and monthly usage.
GET /api/v1/tracks — your uploaded tracks (id, filename, size, created), newest first.
GET /api/v1/usage — this month's export and stem counters against your plan limits.
Step 5 · A minimal integration
Python example — list your library:
import requests
r = requests.get("https://www.quantaramusic.com/api/v1/tracks",
headers={"X-API-Key": "qm_live_YOUR_KEY"})
for t in r.json()["tracks"]:
print(t["filename"], t["size"])
From here, sync metadata into your catalog system, trigger notifications when new masters land, or reconcile usage for client billing.
Honest scope & roadmap
Mastering itself currently runs in the browser with Web Audio — that's what makes the Studio free of upload-render queues. The v1 API therefore covers account, library and usage; it does not render masters server-side. A render API is on the roadmap and will be announced when it's real — we don't ship endpoints that pretend.
Security notes
Keys are stored as SHA-256 hashes — a database leak cannot reveal them. Every create/revoke is logged to your account activity. Treat keys like passwords: never commit them to git, rotate them if a machine is decommissioned, and use one key per integration so revocation is surgical.
Frequently asked questions
The Label plan. Free, Pro and Studio accounts see a locked API Keys section with an upgrade prompt.
Not yet — mastering runs client-side in the Studio. The v1 API manages your account and library; a server-side render API is on the roadmap.
It stops authenticating immediately. Active integrations using it receive 401 responses.
Yes, 120 requests per minute per source. Contact us if your integration needs more.