QUODD API Token Authentication and Encryption

QUODD supports both static and encrypted API tokens for authentication.

Encrypted tokens are required for API requests made directly from client-side applications, such as websites and mobile apps, to prevent exposure of the customer's authentication credentials.

QUODD uses AES-128 encryption in Cipher Feedback (CFB8) mode. Encrypted tokens include a timestamp and expire after a configurable period of up to 30 minutes.
Customers can configure their encryption key, initialization vector (IV), and token expiration settings under My Account > Account > Settings.

For server-side API requests, customers can continue using their standard authentication tokens.