Skip to main content



The Quiltt API uses Bearer Tokens for authentication. There are two types of tokens, depending on the scope of authorization required: Session Tokens and API Secrets.

AnchorThe API Secret

The API Secret is a persistent credential used to administer a deployment, and manage its data and user profiles.

It should only be used for server-to-server communication and should never be exposed in client-side code.

Authorization: Bearer {{API_SECRET}}

AnchorThe Session Token

A Session Token is a short-lived, user-specific token used to interact with a user’s data via GraphQL.

Session Tokens are valid for the duration of an active User Session, and, when properly handled, can be used in client-side code.

Authorization: Bearer {{SESSION_TOKEN}}

There are several flows to create a Session Token, depending on your use-case. These approaches support authenticating existing users, as well as creating new users on the fly:


The Server-Side flow allows your server to generate a Session Token on behalf of a user, authenticating via your API Secret.


The Passwordless flow allows your end-user to generate a Session Token on their own behalf, authenticating via a one-time passcode sent to their phone or email.


The Self-signed flow allows you to generate User Sessions using a signing secret, without having to call the Quiltt API. Contact to request your signing secret.