Qualflare access tokens (API keys)

Create, use and revoke Qualflare project access tokens (qfp_), the API keys of the qf CLI, scripts and MCP agents. New tokens expire after at most 90 days.

In Qualflare, an access token is a project-scoped API key that the qf CLI, scripts, integrations and AI coding agents over MCP authenticate with; a new token starts with qfp_ and expires after 7, 30, 60 or 90 days.

Every token can read the project and upload test results. Only a token created with Allow writes can also create and edit test cases, steps, defects and suite coverage over the API and MCP, and run imports. You can't change this later: create a new token and revoke the old one (or ask a Maintainer or Owner to).

A token never has more access than its creator. Qualflare checks the creator's current project role on every request: reading needs Viewer or higher, and uploading or writing needs Editor or higher. Lowering or removing that role takes effect immediately, and a token stops working if its creator's account is deactivated.


Where	Project Settings > Access Tokens
Scope	One project
Format	New tokens start with `qfp_`
Expiration	7, 30, 60 or 90 days (default 30)
Access	Read & upload, or Read, upload & write with Allow writes
Create	Editor+ · project (requires the Editor role or higher in the project)
Revoke (in the app)	Maintainer+ · project (requires the Maintainer role or higher in the project)
Limit	20 tokens per project that aren't revoked
Used by	The qf CLI, scripts and integrations, and MCP clients

Accessing tokens

Go to Project Settings > Access Tokens to manage your project's tokens.

Each token shows its access level, its owner, and how long it has left.

Creating a token

You need the Editor role or higher to create a token.

Click Create Access Token
Enter a Name of 3 to 100 characters (e.g., "GitHub Actions", "Local Dev")
Choose an Expiration: 7, 30, 60 or 90 days (default 30)
Tick Allow writes only if the token must change data. Uploads don't need it.
Click Create, and confirm it's you if asked
Copy the token immediately — it is only shown once after creation

Pick when the token expires, and tick Allow writes only if the token must change data.

Access tokens are only displayed once at creation. Store it securely in a password manager or as an encrypted CI/CD secret immediately.

Qualflare shows a new token only once, so copy it before you leave the page.

A project can have up to 20 tokens that aren't revoked, and expired tokens count until they're revoked. A new project may already have a Default token with Read & upload access that expires after 30 days.

Token fields

Column	Description
Name	The token's name and the start of its value
Access	Read & upload, or Read, upload & write with Allow writes
Owner	The person who created the token
Date Created	Date the token was created
Expires	Days left and the date. Expires soon in the last 7 days (except 7-day tokens), then Expired: the token stops working

Maintainers and Owners see every token in the project. Others see only their own.

Revoking a token

Open the ⋯ menu on the token's row, choose Revoke, then confirm with Revoke token. In the app, only Maintainers and Owners can revoke. For an Editor, Revoke is disabled, even on a token they created, with the note "Ask a maintainer or owner to revoke this token." Revoking is immediate and can't be undone: the CLI, CI pipelines, scripts and agents that use the token stop working. To restore access, create a new token and update it wherever the old one was used.

In the app, only Maintainers and Owners can revoke a token.

Qualflare emails a token's creator 7 days before it expires (not for 7-day tokens).

Using tokens with the CLI

Install the CLI first.

Save the token under a local identifier with qf login, which asks for it at a hidden prompt. Then prefix your commands with that identifier:

qf login myapp
qf myapp collect results.xml

For the formats collect uploads, see Collect Test Results.

In CI, expose the token secret as the QF_TOKEN environment variable. qf login reads it, and --force replaces an existing identifier without asking:

qf login ci --force
qf ci collect test-results/*.xml

Don't pass the token as an argument: shell history and the process list keep it.

See CLI Configuration for details on the identifier model, credentials file location, and available options.

Using tokens with a coding agent

The same token connects an AI coding agent to Qualflare over MCP — no separate key. An agent that creates or edits data needs a token created with Allow writes.

In bash or zsh, run read -rs QF_TOKEN, paste the token and press Enter. Nothing is shown, and the token stays out of your shell history. Then add the server to Claude Code:

claude mcp add --transport http qualflare https://api.qualflare.com/mcp \
  --header "Authorization: Bearer $QF_TOKEN"

Claude Code stores the header, token included, in its own MCP configuration: treat that file like the token.

See Connect a coding agent for other clients, and MCP Server for every tool an agent can call.

Why a token stops working

It expired.
Someone revoked it.
Its creator's role was lowered or removed (roles).
Its creator signed out everywhere, reset their password or locked their account (Account security).
The workspace turned on a 2FA requirement (Workspace Settings) or an SSO requirement (SSO & SCIM).
Its creator's account was deactivated or deleted.

Requests with such a token get 401 with invalid or expired access token; a creator whose role is too low gets 403 with no project access; a write with a read-only token is refused with the read-only error quoted in MCP server reference. See Troubleshooting.

Security best practices

Use one token per environment — separate tokens for local dev, staging, and production
Store in CI secrets — never commit tokens to source code
Rotate before expiry — when the reminder email or Expires soon appears, create a new token, update your CI secret, then revoke the old one (or ask a Maintainer or Owner to)
Leave Allow writes off — unless the token must change data
Revoke unused tokens — clean up tokens for tools or environments no longer in use
Use descriptive names — "GitHub Actions — Production" is clearer than "key1"

To store a token as a CI secret, see CI/CD and the Open Source CI setup.

Guides: Connect a coding agent (MCP) · CI/CD Integration · GitHub Action
Reference: MCP server reference · Project Settings Reference
CLI/API: CLI Configuration

Access Tokens