Authentication

Quiltt uses two authentication scopes: Environment-level for administrative operations, and Profile-level for user-specific data access.

Link to this section#Environment Scope

Use Environment scope for administrative operations: issuing Session tokens, managing Profiles, ACH Account Numbers, and Processor Tokens.

Link to this section#API Secret

Pass your API Key as a Bearer token:

Link to this section#Profile Scope

Use Profile scope to access an individual Profile's financial data via GraphQL or pre-authenticate the Connector.

Link to this section#Session Tokens

Issue Session tokens server-side, then use them client-side for GraphQL queries or Connector authentication.

Properties:

• Expire after 24 hours
• Rate limited per Profile: 10/hour, 20/day
• Client-safe (scoped to single Profile)

Link to this section#Basic Auth

For server-to-server Profile access without Session token rate limits, use Basic Auth with Base64-encoded profileId:API_KEY_SECRET:

Examples:

Link to this section#Quick Start

New to Quiltt authentication? Try our Authentication Tutorial for a hands-on introduction with working code examples.

Link to this section#Auth API Reference