Build with Qoblox.

Quick start

Public script discovery does not require an API key. This example runs on the same origin as Qoblox. For another client, prepend your deployment’s origin to the request path.

const response = await fetch('/api/v1/scripts?sort=trending');
if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}
const { data: scripts } = await response.json();
console.log(scripts);

JSON responses wrap the result in data. Script records include their id, slug, title, and creator details.

API keys

API keys let external services call authenticated Qoblox endpoints with Authorization: Bearer. Manage them from your dashboard. New keys are shown once, then stored as hashes.

// Run on your server. Set both environment variables first.
const origin = process.env.QOBLOX_ORIGIN;
const key = process.env.QOBLOX_API_KEY;
if (!origin || !key) throw new Error('Missing Qoblox configuration');
const response = await fetch(new URL('/api/v1/me/bookmarks', origin), {
  headers: {
    Authorization: `Bearer ${key}`
  }
});
if (!response.ok) {
  throw new Error(`Request failed: ${response.status}`);
}
const { data: bookmarks } = await response.json();

Key management routes require your signed-in browser session and a CSRF token. Bearer keys cannot manage API keys, edit your profile, manage sessions, request account deletion, or manage profile comments. Keep keys on your server, never in browser bundles or public repositories.

Replace a key without interrupting your service

1. Create a new key and save its one-time token.
2. Update your service configuration and test an authenticated request.
3. Revoke the old key from API access. Requests using it will return 401.

Read endpoints

All paths below are relative to /api/v1. Replace braces with the requested identifier.

Filter and sort scripts

Use these parameters with GET /scripts.

The current list endpoint returns up to 20 records. Tag filtering and cursor pagination are not implemented in the current list handler.

Retrieve source code

The /code endpoint returns text rather than JSON. Use response.text() to read it. Source and revision requests use the script’s UUID, not its slug.

// Replace SCRIPT_UUID with a script's id from the list response.
const response = await fetch('/api/v1/scripts/SCRIPT_UUID/code');
if (!response.ok) {
  throw new Error(`Source unavailable: ${response.status}`);
}
const source = await response.text();

Access & errors

Some resources require a signed-in user or group membership. Access depends on the resource and the current session or bearer key; a missing or inaccessible resource may return 404.

Check the HTTP status before parsing a response. JSON endpoints and plain-text endpoints can return different error bodies, so do not assume every error is JSON.

Browser account and profile-comment mutations require a session and CSRF token. Integration endpoints accept bearer credentials directly. Keys act with your account’s permissions on those endpoints and remain valid until revoked. Scoped keys and automatic expiration are not currently supported.