# Authentication
URL: https://www.quiltt.dev/authentication
Description: Securely authenticate with Quiltt's API using Environment-level or Profile-level scopes. Learn about Bearer tokens, Session tokens, and Basic Auth.

Quiltt uses two authentication scopes: Environment-level for administrative operations, and Profile-level for user-specific data access.

## Environment Scope

Use Environment scope for administrative operations: issuing Session tokens, managing Profiles, 

ACH

 Account Numbers, and Processor Tokens.

### API Secret

Warning:
Server-side only. Never expose your API Key in client-side code or version control.

Pass your API Key as a Bearer token:

```yaml
Authorization: Bearer <API_KEY_SECRET>
```

## Profile Scope

Use Profile scope to access an individual Profile's financial data via GraphQL or pre-authenticate the Connector.

### Session Tokens

[Issue Session tokens](/authentication/issuing-session-tokens) server-side, then use them client-side for GraphQL queries or Connector authentication.

```yaml
Authorization: Bearer <SESSION_TOKEN>
```

**Properties:**

- Expire after 24 hours
- Rate limited per Profile: **10/hour, 20/day**
- Client-safe (scoped to single Profile)

Destructive:
Cache tokens client-side and revoke on logout to avoid hitting rate limits. See [Issuing Session Tokens](/authentication/issuing-session-tokens) for implementation.

### Basic Auth

For server-to-server Profile access without Session token rate limits, use Basic Auth with Base64-encoded `profileId:API_KEY_SECRET`:

```yaml
Authorization: Basic <Base64-encoded profileId:API_KEY_SECRET>
```

**Examples:**

Code Examples:

  ```typescript
    const encoded = Buffer.from(`${profileId}:${API_KEY_SECRET}`).toString("base64")
    ```
  ```python
    encoded = base64.b64encode(f"{profileId}:{API_KEY_SECRET}".encode()).decode()
    ```
  ```ruby
    encoded = Base64.strict_encode64("#{profileId}:#{API_KEY_SECRET}")
    ```
  ```php
    $encoded = base64_encode($profileId . ":" . $API_KEY_SECRET);
    ```

Warning:
Server-side only. Never expose your API Key in client-side code or version control.

## Quick Start

New to Quiltt authentication? Try our [Authentication Tutorial](/get-started/tutorials/authentication) for a hands-on introduction with working code examples.

## REST API Reference

REST API Note: