Quick Capture
Quick Capture is the side door into idea creation: a per-workspace token that lets an
external tool — Raycast, an iOS Shortcut, a bookmarklet, a bare curl call — create an
idea without ever logging in. It writes exactly the same idea shape as the in-app
Quick-add bar; it just gets there without a Cognito session.
This page covers the user-facing feature. For the wire-level contract, see API
Reference → Quick Capture. The authoritative spec is
specs/features/quick-capture.md in the repo. For where Quick Capture fits alongside
the other ways to capture an idea, see Idea Capture &
Management and Getting Started → Capturing
Ideas.
What it does
- A workspace member generates a capture token from Settings.
- Anyone holding that token can
POSTa piece of text to/api/quick-capturewith the token in a header — no login, no app session. - The text becomes a new idea in that workspace,
status: new, ready to be triaged like any other idea — including AI title generation (see below).
There is no standalone public "quick add" web page in the shipped product. An
earlier design sketched a /quick-add?token= form page for exactly this use case;
it was never built. Today, "capture" means an HTTP call — curl, Raycast, an iOS
Shortcut — not a page you open in a browser.
AI title generation, same as everywhere else
Whatever text you send as title is not stored as the title — it's treated as
free-form content. The backend calls Bedrock to generate a short, punchy title from
it, and stores your original text as description. This is the identical behavior to
in-app idea creation — see AI title generation.
A description field in the request body is not read; only title (as content) and
tags are.
Managing your token
Settings → Quick Capture (per workspace) shows:
| Field | What it is |
|---|---|
| Workspace ID | Read-only, copyable |
| Token | The current token, or "Not generated" |
| API URL | {apiDomain}/api/quick-capture, copyable |
| Regenerate Token | Mints a brand-new token for this workspace |
| curl example (collapsible) | A ready-to-run command using the current token |
Regenerating does not invalidate the old token. Clicking "Regenerate Token"
creates a new token and points this workspace and your user profile at it — but the
previous token record is left in the database untouched, and it will keep
authenticating capture requests indefinitely. There is no UI control that explicitly
revokes a token either — the backend has a working DELETE /api/quick-capture/token endpoint, but no button in Settings calls it.
Practically, this means: if you suspect a token has leaked, regenerating from the UI does not guarantee the old value stops working. See Known limitations.
Who can capture with a token
A token is tied to the (user, workspace) pair that generated it. At capture time,
the system checks that the token's own user is still a member of the token's
workspace — not the caller, who (by design) has no identity at all. If that user is
later removed from the workspace, the token starts failing with a permission error
even though it was never explicitly revoked.
| Action | Who authenticates | What's checked |
|---|---|---|
Capture an idea (POST /api/quick-capture) | The token itself, via X-Capture-Token header | The token's own user must still be a workspace member |
Generate a token (POST /api/quick-capture/token) | You, via your normal login | You must be a member of the workspace you're generating for |
Revoke a token (DELETE /api/quick-capture/token) | You, via your normal login | Only ever touches your own currently-active token |
Known limitations
These are gaps between an earlier product design and what's actually shipped —
documented here so they aren't silently assumed away. See
specs/features/quick-capture.md#known-gaps for the full list.
- No standalone public capture page (
/quick-add?token=) — capture is API-only today. - No Slack notification is sent when an idea is captured this way, despite an earlier design describing one.
- No quick-capture-specific rate limit — only the API-wide default throttle applies.
- Regenerating a token does not invalidate the previous one (see above).
- There's no "Revoke" button in the UI, even though the backend endpoint exists and is tested.
- Token "revocation" internally is a hard delete of the token record, not a soft
revoke flag — the
revokedfield on a token is set tofalseat creation and never flipped totrueby any code path.
See also
- API Reference → Quick Capture — the full REST contract.
- Idea Capture & Management — the idea data model and lifecycle that Quick Capture feeds into.
- Getting Started → Capturing Ideas — a walkthrough of all the ways to get an idea into lk-wiz.