The Embedded Finance Index is live: 6,292 companies and 1,383 providers, mapped across the stack. Explore the Index →

Apideck Vault

Hosted auth and connection UI for every integration

Give your customers one place to connect 170+ integrations: sign in with OAuth or enter API keys, configure settings, and fix broken connections. Apideck stores the credentials encrypted, so your product never handles a token.

Get started for free See how it works

OAuth and API keys
Encrypted credential storage
SOC 2 Type II

Apideck Vault showing a customer's CRM integrations

QuickBooks

Accounting API

callable

What is Apideck Vault?

Apideck Vault is the hosted connection layer of the Apideck Unified APIs. Your customers use it to choose an integration, authorize it with OAuth or credentials, and configure it. Vault keeps those credentials encrypted and up to date, so your product only sends a consumer ID with each API call. You can redirect to Hosted Vault, open it as a modal in your app, or build your own UI on the Vault API.

Everything between your customer and their credentials

Authentication is the part of an integration nobody wants to build twice. Vault handles it once for every connector.

Managed OAuth and API keys

Vault runs the OAuth redirect and consent, refreshes access tokens, and checks API keys and credentials before a connection goes live.

Connection settings

Customers pick a tenant or company and set the configurable resources per connection, so you skip building a settings screen for every integration.

Connection health

Every connection has a state. When credentials stop working, customers see it in Vault and can reauthorize without opening a ticket.

Logs for support

Customers can see the requests made on their connections in Vault, and your team can pull the same logs per customer through the Vault API.

Three calls from sign-up to first API request

Vault sits between your app and the integration. You create the session, your customer connects, and every Unified API call after that is authenticated for you.

1
Create a session
Your server calls POST /vault/sessions with your customer ID, a redirect URL and optional branding. Sessions are short lived.
2
Open Vault
Redirect to the session URL or open Vault as a modal in your app. The customer connects and configures the integration.
3
Call the Unified API
Once the connection is callable, call any Apideck Unified API with the same consumer ID. Vault supplies the credentials.

POST/vault/sessions

Authorization: Bearer <APIDECK_API_KEY>x-apideck-app-id: <APP_ID>x-apideck-consumer-id: <CUSTOMER_ID>{  "redirect_uri": "https://app.yoursaas.com/settings/integrations",  "consumer_metadata": {    "account_name": "Acme Inc",    "user_name": "Jane Doe",    "email": "jane@acme.com"  },  "settings": {    "unified_apis": ["accounting", "crm"],    "auto_redirect": true  },  "theme": {    "vault_name": "Your app",    "primary_color": "#6B4EFF"  }}

Hosted, embedded, or fully yours

All three options run on the same session and the same connections, so you can start hosted and move the flow into your app later.

Hosted Vault

Redirect customers to the session URL. Isolation mode shows a single integration, and auto redirect sends them back once the connection is ready.

Authorizing connections guide

Embedded modal

Open Vault inside your app with @apideck/vault-js, or the React and Vue packages. Callbacks fire when the modal opens, closes, or a connection changes.

Vault JS guide

Your own UI

Build the flow yourself on the Vault API: list connections, send customers to each authorize URL, update settings, and import connections you already have.

Vault API reference

Looks like your product, behaves the way you set it

Branding and behavior are set per session, so each customer can get a different experience without a separate deployment.

Theme

Your logo, favicon and product name
Primary, sidebar background and sidebar text colors
Links to your privacy policy and terms
Customer name, email and avatar in the sidebar
English, Dutch, German, French or Spanish

Session settings

Which unified APIs your customers see
Show or hide the sidebar, logs, suggestions and guides
Which actions customers can take: delete, disconnect, reauthorize, disable
Hide configurable resources, or open straight to field mapping
Session length up to one week, and a sandbox banner for test environments

Know when a connection is ready

Every connection reports a state. Read it through the Vault API, react to changes with the onConnectionChange callback, or let Vault redirect the customer back to your app when the connection becomes callable.

available
Offered to the customer, not added yet
added
Added, credentials or sign-in still needed
authorized
Signed in, one more setting to pick
invalid
Credentials rejected, needs a fix
callable
Connected and ready for API calls

Read the connection states guide

Credentials live in Vault, not in your stack

OAuth tokens and API keys are stored encrypted in Vault and never sent to your servers. The business data your product reads through the Unified APIs passes through in real time and is not stored by Apideck.

How zero data retention works Security at Apideck

Credentials stored encrypted, refreshed by Apideck
Start on Apideck sandbox OAuth apps, ship with your own so customers see your brand
Session tokens are short lived and created server side
Customer business data is passed through, not stored
SOC 2 Type II and GDPR, hosted in the EU by default

See Vault in the product

Short guided walkthroughs of the parts of the platform this page describes.

Browse all product tours

Connectors your customers can add in Vault

Every live and beta connector authenticates through Vault, with the same session and the same UI.

Access Financials