PG&E Share My Data OAuth 2.0 Authorization API
The OAuth 2.0 authorization server behind Share My Data, implemented to meet the NAESB ESPI authorization profile. Two token classes are issued separately: a client access token via the client_credentials grant for third-party-level resources, and a per-customer access/refresh token pair via the authorization_code grant after a PG&E customer authenticates on PG&E's site and selects what to share. Authorized scope is returned as an ESPI function-block string (for example FB=1_3_8_13_14_18_19_31_32_35_37_38_39_40_4_5_10_15_16_46_47 with AdditionalScope, IntervalDuration, BlockDuration, HistoryLength and AccountCollection parameters), documented in PG&E's supported function-block scope-string mapping. PG&E publishes both a production authorization server at /datacustodian/oauth/v2/ and a separate test authorization server at /datacustodian/test/oauth/v2/ used during mandatory registration testing. Verified live anonymously on 2026-07-27: GET on the token endpoint returns HTTP 405 {"error":"invalid_request","error_description":"GET not permitted"}, and an unparameterised request returns HTTP 400 {"error":"invalid_request","error_description":"Missing grant_type"} — real RFC 6749 error responses from a Mulesoft-API-Gateway. Except for the browser redirects in the authorization-code flow, every call must carry the third party's client SSL certificate over mutual TLS. No /.well-known/openid-configuration is served (HTTP 404 on both www.pge.com and api.pge.com); this is OAuth 2.0, not OpenID Connect.