Qeenai Authentication

generated: '2026-08-12'
method: searched
source: >-
  https://github.com/fodoole/qeen-mobile-sdk-ios (README + published .swiftinterface),
  https://github.com/fodoole/qeen-maven (README), https://cdn.qeen.ai/sdk/qeen.js,
  and live unauthenticated probes of https://users.qeen.ai/api/v1/* on 2026-08-12
docs: https://github.com/fodoole/qeen-mobile-sdk-ios#usage
note: >-
  Qeen publishes no OpenAPI, so nothing here is derived from a spec. Every scheme below is read
  from a first-party artifact the company distributes publicly (its SDK source, its SDK READMEs)
  or observed on a live unauthenticated request. Credentials themselves are NOT self-serve:
  both mobile READMEs state the host and API key "are shared privately by email — contact
  tech@qeen.ai", so there is no public key-issuance flow to document.

summary:
  types: [apiKey, cookie]
  api_key_in: [sdk-configuration]
  oauth2_flows: []
  oauth2: false
  openid_connect: false
  mutual_tls: false
  self_serve_credentials: false
  credential_request_channel: tech@qeen.ai

schemes:
  - name: MobileSDKApiKey
    type: apiKey
    in: sdk-configuration
    parameter: apiKey
    surface: Qeen Mobile Analytics SDK (iOS + Android)
    signature: 'QeenSDK.configure(apiKey: String, host: String, debug: Bool = false, options: [String: Any] = [:])'
    sources: [packages/qeenai-ios-sdk-interface.swiftinterface]
    note: >-
      The key is paired with a customer-provisioned `host` — the SDK has no default ingestion
      endpoint. The compiled framework binary names only PostHog's own asset hosts
      (us.i.posthog.com, eu.i.posthog.com and their asset siblings), consistent with the README's
      statement that PostHog is "baked INTO the framework and hidden"; the customer's `host` is
      the PostHog-compatible ingestion endpoint Qeen provisions for that account.
    key_prefix: null
    key_prefix_note: not published
    rotation: not documented

  - name: WebSDKProjectBinding
    type: apiKey
    in: script-url
    parameter: 'path segment: /qeen-script/{hash(pageUrl)}{hash(userDeviceId)}'
    surface: Qeen Web SDK loader (https://cdn.qeen.ai/loader/main.js)
    sources: [https://cdn.qeen.ai/loader/main.js, https://cdn.qeen.ai/sdk/qeen.js]
    note: >-
      The browser loader carries no secret. It derives a 7-character non-cryptographic hash (a
      djb2-style rolling hash, base-32, zero-padded) of the page URL and of a device id persisted
      in localStorage under "fodoole_uid", and requests the content-replacement script at
      fodoole-web-analytics-qfan6cresq-ew.a.run.app/qeen-script/{hash}. Project and website
      identity (projectId, websiteId, contentServingId) then arrive from the server in the client
      config rather than being embedded in the page. This is site-binding, not authentication —
      there is no bearer credential on the browser data plane.

  - name: CustomerPlatformSession
    type: cookie
    in: cookie
    surface: https://users.qeen.ai/api/v1/
    framework: Django REST Framework
    sources: [live probe]
    note: >-
      The customer web application (app.qeen.ai, a Nuxt SPA) calls its backend at users.qeen.ai
      with credentials:"include". Token lifecycle endpoints are POST /api/v1/auth/verify-token/
      and POST /api/v1/auth/refresh-token/. Unauthenticated requests to business endpoints return
      DRF's standard 401 body {"detail":"Authentication credentials were not provided."}. This is
      the product's own session surface, not a developer API — no key issuance, no scopes, no
      public documentation.
    evidence:
      - {url: 'https://users.qeen.ai/api/v1/core/websites', status: 401, body: '{"detail":"Authentication credentials were not provided."}'}
      - {url: 'https://users.qeen.ai/api/v1/subscriptions/products', status: 401, body: '{"detail":"Authentication credentials were not provided."}'}
      - {url: 'https://users.qeen.ai/api/v1/auth/verify-token/', status: 400, body: '{"valid":false,"message":"... Token is required. ..."}'}
      - {url: 'https://users.qeen.ai/api/v1/auth/verify-token/', method: GET, status: 405, body: '{"detail":"Method \"GET\" not allowed."}'}

unauthenticated_surfaces:
  - url: https://fodoole-web-analytics-qfan6cresq-ew.a.run.app/search-results
    status: 400
    body: '{"error":"Empty search query provided"}'
    note: >-
      Answers anonymously and validates input rather than rejecting on auth — the embedded search
      widget's backing endpoint takes no credential from the browser.
  - url: https://fodoole-web-analytics-qfan6cresq-ew.a.run.app/sdk/client-config
    status: 400
    body: 'Unsupported URL'
    note: Anonymous; requires site/page parameters the loader supplies.

not_found:
  - oauth2 authorization server
  - openid-connect discovery
  - scoped access tokens
  - public API key self-service / developer portal
  - mTLS