Auth Strategies

Templates that define which credential fields a connected system needs.

An authentication strategy is a template for a target system: which fields the hosted form should collect (username/password, bearer token, custom headers, TOTP, and so on), and how Rubie should authenticate with them at run time.

Every credential session is created against exactly one strategy.

You don’t manage strategies yourself

Rubie provisions strategy ids (strat_...) for your account — typically one per system you integrate with. Pass the relevant id as strategy_id when creating a credential session. You don’t need to fetch a strategy catalog or render your own credential form; the hosted collection page uses the strategy to decide what to show.

{
  "strategy_id": "strat_NQ",
  "return_url": "https://app.example.com/settings/integrations/connected"
}

Hold a small lookup in your app if you support multiple source systems:

const INTEGRATIONS = {
  legacy_crm: {
    strategyId: "strat_...",
    blueprintKey: "bp_...",
  },
  // ...
};

Strategy types

Type	Typical fields
USERNAME_PASSWORD	Username + password
BEARER_TOKEN	API token with optional prefix
BASIC_AUTH	HTTP Basic username + password
CUSTOM_HEADER	A single custom HTTP header value
CUSTOM	Account-defined fields
OAuth	Browser redirect; tokens vaulted by Rubie

Two-factor method

Strategies may also declare a 2FA method:

Value	Meaning
none	No 2FA
totp	Time-based OTP — collected and stored during the hosted session
manual	Human-entered OTP at run time

You don’t configure this from the API — it’s part of the strategy Rubie sets up for the integration.