> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> API authentication methods for the Quint cloud API

# Authentication

All API endpoints except health checks require authentication. Quint supports two authentication methods: **Deploy Tokens** and **Supabase JWTs**.

```mermaid theme={null}
flowchart TD
    subgraph Clients
        Daemon["quint daemon"]
        Dash["Dashboard / Admin"]
    end

    subgraph Auth["Authentication"]
        DT["Deploy Token\n(qt_deploy_*)"]
        JWT["Supabase JWT\n(ES256 / HS256)"]
    end

    subgraph API["api.quintai.dev"]
        Verify["Token Verification\n(SHA-256 hash lookup or JWKS)"]
        RLS["Row-Level Security\n(org isolation)"]
    end

    Daemon -->|"Authorization: Bearer qt_deploy_..."| DT
    Dash -->|"Authorization: Bearer eyJ..."| JWT
    DT --> Verify
    JWT --> Verify
    Verify --> RLS
```

## Deploy Tokens (`qt_deploy_` prefix)

Deploy tokens are generated for fleet enrollment -- used by the Quint daemon to authenticate when pushing events and session data to the cloud API. They are one-time display tokens; the raw value cannot be retrieved after creation.

Tokens are SHA-256 hashed before database storage.

```bash theme={null}
curl https://api.quintai.dev/v1/events \
  -H "Authorization: Bearer qt_deploy_9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c"
```

### Token Management

```bash theme={null}
# Create a deploy token
curl -X POST https://api.quintai.dev/v1/deploy-tokens \
  -H "Authorization: Bearer YOUR_SUPABASE_JWT" \
  -H "Content-Type: application/json" \
  -d '{"name": "production-fleet-01"}'

# List deploy tokens
curl https://api.quintai.dev/v1/deploy-tokens \
  -H "Authorization: Bearer YOUR_SUPABASE_JWT"
```

## Supabase JWT

Dashboard users authenticate via Supabase. The JWT can also be used directly against the API for management operations like creating deploy tokens or managing the tenant/org.

JWTs are verified using ES256 JWKS (primary) with HS256 fallback.

```bash theme={null}
curl https://api.quintai.dev/v1/sessions \
  -H "Authorization: Bearer eyJhbGciOiJFUzI1NiIs..."
```

## Rate Limits

Ingestion endpoints (`POST /v1/events/ingest` and `POST /v1/sessions/ingest`) are rate-limited per organization. When rate limited, the API returns `429 Too Many Requests`.

## Error Responses

<Tabs>
  <Tab title="Missing Credentials">
    ```json theme={null}
    {
      "error": "Authorization header required"
    }
    ```

    **Status:** 401 Unauthorized
  </Tab>

  <Tab title="Invalid Credentials">
    ```json theme={null}
    {
      "error": "Invalid token"
    }
    ```

    **Status:** 401 Unauthorized
  </Tab>

  <Tab title="Rate Limited">
    ```json theme={null}
    {
      "error": "Rate limit exceeded"
    }
    ```

    **Status:** 429 Too Many Requests
  </Tab>
</Tabs>

## Unauthenticated Endpoints

These endpoints do **not** require authentication:

* `GET /health` -- Liveness check
* `GET /ready` -- Readiness check