> ## Documentation Index
> Fetch the complete documentation index at: https://rubie.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth Strategies

> Templates that define which credential fields a connected system needs.

An authentication strategy is a template for a target system: which fields the
hosted form should collect (username/password, bearer token, custom headers,
TOTP, and so on), and how Rubie should authenticate with them at run time.

Every credential session is created against exactly one strategy.

## You don't manage strategies yourself

Rubie provisions strategy ids (`strat_...`) for your account — typically one per
system you integrate with. Pass the relevant id as `strategy_id` when creating a
credential session. You don't need to fetch a strategy catalog or render your
own credential form; the hosted collection page uses the strategy to decide what
to show.

```json theme={null}
{
  "strategy_id": "strat_NQ",
  "return_url": "https://app.example.com/settings/integrations/connected"
}
```

Hold a small lookup in your app if you support multiple source systems:

```ts theme={null}
const INTEGRATIONS = {
  legacy_crm: {
    strategyId: "strat_...",
    blueprintKey: "bp_...",
  },
  // ...
};
```

## Strategy types

| Type                | Typical fields                            |
| ------------------- | ----------------------------------------- |
| `USERNAME_PASSWORD` | Username + password                       |
| `BEARER_TOKEN`      | API token with optional prefix            |
| `BASIC_AUTH`        | HTTP Basic username + password            |
| `CUSTOM_HEADER`     | A single custom HTTP header value         |
| `CUSTOM`            | Account-defined fields                    |
| OAuth               | Browser redirect; tokens vaulted by Rubie |

## Two-factor method

Strategies may also declare a 2FA method:

| Value    | Meaning                                                         |
| -------- | --------------------------------------------------------------- |
| `none`   | No 2FA                                                          |
| `totp`   | Time-based OTP — collected and stored during the hosted session |
| `manual` | Human-entered OTP at run time                                   |

You don't configure this from the API — it's part of the strategy Rubie sets up
for the integration.