Authentication

Quiltt uses two authentication scopes: Environment-level for administrative operations, and Profile-level for user-specific data access.

Link to this section#Environment Scope

Use Environment scope for administrative operations: issuing Session tokens, managing Profiles, ACH Account Numbers, and Processor Tokens.

Link to this section#API Secret

Pass your API Key as a Bearer token:

Authorization: Bearer <API_KEY_SECRET>

Link to this section#Profile Scope

Use Profile scope to access an individual Profile's financial data via GraphQL or pre-authenticate the Connector.

Link to this section#Session Tokens

Issue Session tokens server-side, then use them client-side for GraphQL queries or Connector authentication.

Authorization: Bearer <SESSION_TOKEN>

Properties:

• Expire after 24 hours
• Rate limited per Profile: 10/hour, 20/day
• Client-safe (scoped to single Profile)

Link to this section#Basic Auth

For server-to-server Profile access without Session token rate limits, use Basic Auth with Base64-encoded profileId:API_KEY_SECRET:

Authorization: Basic <Base64-encoded profileId:API_KEY_SECRET>

Examples:

const encoded = Buffer.from(`${profileId}:${API_KEY_SECRET}`).toString("base64")

encoded = base64.b64encode(f"{profileId}:{API_KEY_SECRET}".encode()).decode()

encoded = Base64.strict_encode64("#{profileId}:#{API_KEY_SECRET}")

$encoded = base64_encode($profileId . ":" . $API_KEY_SECRET);

Link to this section#Quick Start

New to Quiltt authentication? Try our Authentication Tutorial for a hands-on introduction with working code examples.

Link to this section#REST API Reference