Credentials
Two credential types converge on the same request-local identity before any
route sees them.
API keys are the automation path. A key is presented in one place and one
place only:
Authorization: Bearer quantum_<32 hex characters>There is no X-API-Key header and no query-parameter form. Keys are stored as
unsalted SHA-256 digests; the raw key material is returned exactly once, at
creation, and is never recoverable afterwards. Each key carries an identifier, a
role, an optional label, and three optional restrictions described below.
Session cookies are the browser path, used by the QuantumTouch UI. A
successful login sets two cookies: qt_sess, which is HttpOnly, Secure, and
SameSite=Lax, carrying a signed session identifier; and qt_csrf, deliberately
readable by JavaScript so the SPA can echo it back.
The two paths differ in exactly four ways:
| Session cookie | Bearer API key | |
|---|---|---|
| CSRF token required | Yes, on all mutating verbs | No — a header cannot be planted by a cookie attack |
| Identity kind | session |
automation |
| Controller passthrough | Injects the session's controller bearer | Preserves the caller's own header |
| IP allowlist / path scope | Not applicable | Enforced |
Beyond those, a route handler cannot tell the two apart and does not need to.
An integrating script uses a bearer key and never needs a CSRF token.