Rutter Authentication

generated: '2026-11-05'
method: searched
source:
  - https://docs.rutter.com/rest/2024-08-31/basics#authorization
  - https://docs.rutter.com/try-us-out
  - https://docs.rutter.com/rutter-link/overview
  - openapi/_original/rutter-openapi-2024-08-31.json
docs: https://docs.rutter.com/rest/2024-08-31/basics#authorization
summary: >-
  Every Rutter REST request is authenticated with HTTP Basic credentials (client_id as the username and client_secret
  as the password) issued per environment in the Rutter Dashboard, plus a connection-scoped access_token query
  parameter that identifies which end-user connection the call addresses. The access_token is minted by Rutter when a
  connection is created and is obtained by exchanging the short-lived public_token that Rutter Link returns
  (POST /item/public_token/exchange). Rutter Link itself is initialised with a publicKey. The published OpenAPI
  document declares no securitySchemes; the schemes below are read from the documentation.
schemes:
  - name: basicAuth
    type: http
    scheme: basic
    description: >-
      "Rutter uses your client_id and client_secret keys to control access to our API via HTTP Basic Auth. You can
      find your keys in your dashboard for each of our API environments (sandbox, production)." Header form:
      Authorization: Basic base64({client_id}:{client_secret}).
    docs: https://docs.rutter.com/rest/2024-08-31/basics#authorization
    sources:
      - https://docs.rutter.com/rest/2024-08-31/basics
  - name: accessToken
    type: apiKey
    in: query
    parameter: access_token
    description: >-
      "To identify a specific connection, Rutter uses the access_token query parameter. This token is generated by
      Rutter and is unique to each connection. The access token is acquired by hitting the Exchange Tokens endpoint."
      Declared on 250 of the 285 operations in the published OpenAPI document.
    obtained_via: exchangeToken (POST /item/public_token/exchange)
    docs: https://docs.rutter.com/rest/2024-08-31/basics#authorization
    sources:
      - https://docs.rutter.com/rest/2024-08-31/basics
      - openapi/_original/rutter-openapi-2024-08-31.json
  - name: rutterLinkPublicKey
    type: apiKey
    in: client
    parameter: publicKey
    description: >-
      Rutter Link (the embeddable connection component) is created with Rutter.create({ publicKey }); on success it
      returns a public_token the server exchanges for a connection access_token.
    docs: https://docs.rutter.com/rutter-link/overview
    sources:
      - https://docs.rutter.com/rutter-link/overview
versioning_header:
  name: X-Rutter-Version
  note: Required alongside authentication on every request; supported values 2024-08-31, 2024-04-30, 2023-03-14, 2023-02-07.
oauth: none (Rutter brokers OAuth to the connected platforms inside Rutter Link; its own API exposes no OAuth flow or scopes)