Issuing Session Tokens

Auth API Reference

For complete information on the available endpoints and schemas available in the Auth API, explore the API Reference.

Session tokens authenticate Profile-specific requests to the Connector and GraphQL API. Issue them server-side, use them client-side.

POSThttps://auth.quiltt.io/v1/users/sessions

Required headers:

Rate Limits: 10/hour, 20/day per Profile

Each issuance creates a NEW token counting toward limits. To avoid 429 errors:

Server-to-server? Use Basic Auth instead—no rate limits.

Link to this section#Existing Profile

Provide the Profile ID in the request body:

Returns 201 with the Session token:

Create a Profile and issue a token in one request. Optionally provide Profile attributes or your own UUID:

Returns 201 with token for the new Profile:

Save the userId

Store the returned userId to re-authenticate this Profile later (unless providing your own UUIDs).

Session tokens last 24 hours. Cache client-side to avoid rate limits:

Revoke tokens at logout to free rate limit quota:

Pass tokens to the Connector SDK or GraphQL API to access Profile data.

Provide optional attributes when issuing tokens for existing or new Profiles:

See the API reference for all supported attributes.

Provide your own UUID for new Profiles to maintain referential integrity with external systems:

Or create Profiles directly via the Platform API.

Issue Session tokens on your server without calling the Auth API. Contact us to request a signing secret.

Hit the rate limit (10/hour or 20/day per Profile). Common causes:

Fix: