Your browser is handed a connection.
Never a credential.
Authorising here — on a public HTTPS origin — is what makes a production QuickBooks connection possible at all; Intuit refuses the loopback redirects a desktop app would use. Tokens are encrypted the moment they arrive and stay server-side.
Held for you. The ledger’s access and refresh tokens, encrypted with AES-256-GCM under a key held only in the server environment, plus the company name and expiry so we can refresh before it lapses. Revoked when you disconnect.
A code, not a password. A connection, not a token.
Design-partner seats are invite-only while we are pre-Clerk. The code signs this browser in for 30 days in an httpOnly cookie — there is no password to phish and no session table to leak.
The ledger’s access and refresh tokens, encrypted with AES-256-GCM under a key held only in the server environment, plus the company name and expiry so we can refresh before it lapses.
Every ledger call runs server-side. The browser never receives an access or refresh token, and no credential is written into a URL or a log.