# PG&E Share My Data OAuth 2.0 Authorization API

**Canonical:** https://apis.io/apis/pge/pge-share-my-data-oauth-api/  
**Provider:** Pacific Gas and Electric — https://apis.io/providers/pge/  
**Base URL:** https://api.pge.com/datacustodian/oauth/v2  
**Documentation:** https://www.pge.com/en/save-energy-and-money/energy-saving-programs/smartmeter/third-party-companies.html

PG&E Share My Data OAuth 2.0 Authorization API is one of 2 APIs that [Pacific Gas and Electric](https://apis.io/providers/pge/) publishes on the [APIs.io](https://apis.io/) network. Tagged areas include Authentication, Authorization, Green Button, ESPI, and Security. The published artifact set on APIs.io includes API documentation, an API reference, and authentication docs.

The OAuth 2.0 authorization server behind Share My Data, implemented to meet the NAESB ESPI authorization profile. Two token classes are issued separately: a client access token via the client_credentials grant for third-party-level resources, and a per-customer access/refresh token pair via the authorization_code grant after a PG&E customer authenticates on PG&E's site and selects what to share. Authorized scope is returned as an ESPI function-block string (for example FB=1_3_8_13_14_18_19_31_32_35_37_38_39_40_4_5_10_15_16_46_47 with AdditionalScope, IntervalDuration, BlockDuration, HistoryLength and AccountCollection parameters), documented in PG&E's supported function-block scope-string mapping. PG&E publishes both a production authorization server at /datacustodian/oauth/v2/ and a separate test authorization server at /datacustodian/test/oauth/v2/ used during mandatory registration testing. Verified live anonymously on 2026-07-27: GET on the token endpoint returns HTTP 405 {"error":"invalid_request","error_description":"GET not permitted"}, and an unparameterised request returns HTTP 400 {"error":"invalid_request","error_description":"Missing grant_type"} — real RFC 6749 error responses from a Mulesoft-API-Gateway. Except for the browser redirects in the authorization-code flow, every call must carry the third party's client SSL certificate over mutual TLS. No /.well-known/openid-configuration is served (HTTP 404 on both www.pge.com and api.pge.com); this is OAuth 2.0, not OpenID Connect.

## Machine-readable artifacts (9)

- **Documentation** — https://www.pge.com/assets/pge/docs/save-energy-and-money/energy-savings-programs/OAuth_Authorization_ESPI.pdf
- **Documentation** — https://www.pge.com/assets/pge/docs/save-energy-and-money/energy-savings-programs/Supported-Function-Block-Scope-String-Mapping-Click-Thru-2.0.pdf
- **APIReference** — https://www.pge.com/assets/pge/docs/save-energy-and-money/energy-savings-programs/Supported-APIs.pdf
- **Documentation** — https://www.pge.com/en/save-energy-and-money/energy-saving-programs/smartmeter/third-party-companies.html
- **Registration** — https://sharemydata.pge.com/
- **Authentication** — https://raw.githubusercontent.com/api-evangelist/pge/refs/heads/main/authentication/pge-authentication.yml
- **OAuthScopes** — https://raw.githubusercontent.com/api-evangelist/pge/refs/heads/main/scopes/pge-scopes.yml
- **Sandbox** — https://raw.githubusercontent.com/api-evangelist/pge/refs/heads/main/sandbox/pge-sandbox.yml
- **Reference** — http://naesb.org/espi

## Other Pacific Gas and Electric APIs (1)

- [PG&E Share My Data (Green Button Connect My Data) ESPI API](https://apis.io/apis/pge/pge-share-my-data-espi-api/)

## Tags

Authentication, Authorization, Green Button, ESPI, Security

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/pge/pge-share-my-data-oauth-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/pge/.