How customers authorize

Vault is an embeddable component that lets your customers connect their own accounts. They authenticate directly with QuickBooks, NetSuite or Xero; Apideck stores and refreshes the credentials. You pass a consumer id and never touch a token.

POST /vault/sessions · your backend

// the only Vault call your server has to make

const session = await apideck.vault.sessionsCreate({

consumerId: "acme-corp-123",

});

// → session.data.session_uri (hosted)

// → session.data.token (embedded)

What Vault is

The auth you didn't build. And don't maintain.

Every auth type

OAuth 2.0 where the provider offers it, API keys and session-based auth where it doesn't. Vault presents whatever that connector needs.

Credentials stay with us

Tokens are stored and refreshed by Apideck. Nothing sensitive lands on your servers, so nothing sensitive is yours to leak.

Your brand, or ours

Embed it in your product or hand off to a hosted page. Either way the customer signs in on the provider's own screen.

It tells you what happened

Vault has its own APIs and webhooks — connection created, updated, deleted — so your app reacts without polling.

Vault guide Vault API reference

Interactive

Two ways to ship it. Same session underneath.

Embedded keeps the customer in your app; hosted is a redirect and no frontend code. Pick the one that matches how much control you want over the moment they connect.

Drop the component into your app and open Vault as a modal. Your customer never leaves your product.

When to use it

Smoother UX — the flow happens in place
You need callbacks for connection events
You want control over when and where it opens

Available as

JavaScriptReactVue

@apideck/vault-js — one dependency, one call.

The flow

1
Create a session
your backend calls POST /vault/sessions
2
Open the modal
Vault.open({ token }) with the session token
3
Customer authorizes
on the provider's own screen
4
onConnectionChange fires
your app updates without a page load

Both flavours need a session created from your backend first. Sessions are short-lived and scoped to one consumer.

APIs and webhooks

Vault is an API too.

Everything the widget does, you can do programmatically: list a consumer's connections, update settings, revoke a connection. Webhooks tell you when a customer connects, disconnects or updates one.