Authentication

All API requests to PaperStack require authentication via a Bearer token in the Authorization header.

API Keys

API keys are the primary authentication mechanism. Every request must include a valid, active key.

Key Format

• Live keys: ps_<random_string>
• Test/development keys: ps_test_<random_string>

Rate Limits

Sending Your Key

Include your API key as a Bearer token in the Authorization header:

curl -H "Authorization: Bearer ps_xxxxx" \
  https://api.paperstack.qzz.io/neet/2024/s1/physics.json

import requests

headers = {"Authorization": "Bearer ps_xxxxx"}
response = requests.get(
    "https://api.paperstack.qzz.io/neet/2024/s1/physics.json",
    headers=headers
)
data = response.json()
print(data)

const response = await fetch(
  "https://api.paperstack.qzz.io/neet/2024/s1/physics.json",
  {
    headers: {
      Authorization: "Bearer ps_xxxxx",
    },
  }
);
const data = await response.json();
console.log(data);

package main

import (
  "fmt"
  "io"
  "net/http"
)

func main() {
  client := &http.Client{}
  req, _ := http.NewRequest("GET",
    "https://api.paperstack.qzz.io/neet/2024/s1/physics.json", nil)
  req.Header.Set("Authorization", "Bearer ps_xxxxx")

  resp, err := client.Do(req)
  if err != nil {
    panic(err)
  }
  defer resp.Body.Close()

  body, _ := io.ReadAll(resp.Body)
  fmt.Println(string(body))
}

require "net/http"
require "uri"

uri = URI("https://api.paperstack.qzz.io/neet/2024/s1/physics.json")
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer ps_xxxxx"

response = http.request(request)
puts response.body

Getting an API Key

1. Register for a PaperStack account
2. Log in to your Dashboard
3. Click Generate New Key
4. Copy the key immediately — it will only be shown once
5. Store it securely (e.g., environment variables, secrets manager)

Key Management

Viewing Your Keys

Your Dashboard shows all active keys with:

• Key prefix (first few characters)
• Creation date
• Last used date

Revoking a Key

If a key is compromised or no longer needed:

1. Go to your Dashboard
2. Click Revoke next to the key
3. The key will be immediately invalidated

Note: Revocation is permanent. Generate a new key to replace a revoked one.

CORS & Browser Usage

PaperStack supports cross-origin requests from browser applications. All API endpoints include the following CORS headers:

Using the API from the Browser

// Fetch question data from client-side JavaScript
async function fetchPaper(exam, year, shift, file, apiKey) {
  const response = await fetch(
    `https://api.paperstack.qzz.io/${exam}/${year}/${shift}/${file}`,
    {
      headers: {
        Authorization: `Bearer ${apiKey}`,
      },
    }
  );

  if (!response.ok) {
    throw new Error(`API error: ${response.status}`);
  }

  return response.json();
}

// Usage
const data = await fetchPaper("neet", "2024", "s1", "physics.json", "ps_xxxxx");

Security Warning for Browser Apps

Recommended Architecture for Browser Apps

Browser App
    │
    ▼
Your Backend (proxies requests, stores key securely)
    │
    ▼
PaperStack API

Security Best Practices

• Never expose your API key in client-side code, public repos, or logs
• Use environment variables to store keys in production
• Rotate keys regularly — generate new keys and revoke old ones
• Use separate keys for development and production environments
• Monitor usage on your Dashboard for unusual activity