Aarons Authentication

generated: '2026-08-29'
method: probed
source: >-
  openapi/aarons-hpp-openapi.json (securityDefinitions) +
  https://login.aarons.com/.well-known/openid-configuration +
  https://login.aarons.com/oauth2/default/.well-known/openid-configuration
provider: Aaron's
providerId: aarons
summary: >-
  Aaron's runs two distinct authentication models and publishes neither as developer documentation.
  Customer-facing identity is Okta on a custom domain (login.aarons.com) speaking OpenID Connect and
  OAuth 2.0, with anonymous discovery documents that are fully machine-readable. The one published
  API contract — the Hosted Payment Page service at hpp.aarons.com — declares a single bearer-token
  scheme in its own Swagger document. There is no public developer program, no key issuance flow,
  and no documented way for a third party to obtain either credential.
schemes:
  - id: hpp-bearer
    api: aarons:aarons-hpp
    type: apiKey
    in: header
    name: Authorization
    scheme_name: Bearer
    description: >-
      Declared in the HPP Swagger 2.0 document as securityDefinitions.Bearer, an apiKey scheme
      carried in the Authorization header. Applied at operation level on every non-ping operation.
    applied: per-operation
    source: openapi/aarons-hpp-openapi.json#/securityDefinitions/Bearer
    token_issuance: >-
      Not publicly documented. The contract itself exposes /MemoryBearerToken and /CreateToken
      operations, implying tokens are minted by Aaron's for its own session flow rather than issued
      to third-party developers.
  - id: okta-oidc
    type: openIdConnect
    issuer: https://login.aarons.com
    discovery: well-known/aarons-login-openid-configuration.json
    description: >-
      Okta org authorization server on Aaron's custom domain. Anonymous OIDC discovery is served.
    authorization_endpoint: https://login.aarons.com/oauth2/v1/authorize
    token_endpoint: https://login.aarons.com/oauth2/v1/token
    userinfo_endpoint: https://login.aarons.com/oauth2/v1/userinfo
    jwks_uri: https://login.aarons.com/oauth2/v1/keys
    introspection_endpoint: https://login.aarons.com/oauth2/v1/introspect
    revocation_endpoint: https://login.aarons.com/oauth2/v1/revoke
    end_session_endpoint: https://login.aarons.com/oauth2/v1/logout
    registration_endpoint: https://login.aarons.com/oauth2/v1/clients
    id_token_signing_alg: [RS256]
    pkce: [S256]
    token_endpoint_auth_methods:
      - client_secret_basic
      - client_secret_post
      - client_secret_jwt
      - private_key_jwt
      - none
  - id: okta-oidc-default
    type: openIdConnect
    issuer: https://login.aarons.com/oauth2/default
    discovery: well-known/aarons-login-default-openid-configuration.json
    description: >-
      The custom authorization server the myaccount.aarons.com application names as its issuer.
      This is the one that carries Aaron's own application scope (interclient_access) alongside the
      standard OIDC set.
    source: >-
      https://myaccount.aarons.com/assets/index-CNr2NkAf.js — Aaron's own published application
      bundle names https://login.aarons.com/oauth2/default as the issuer.
grant_types:
  - authorization_code
  - implicit
  - refresh_token
  - password
  - client_credentials      # org authorization server only
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:openid:params:grant-type:ciba
mfa:
  supported: true
  evidence: >-
    Okta MFA grant types are advertised in discovery (urn:okta:params:oauth:grant-type:otp,
    urn:okta:params:oauth:grant-type:oob, and the auth0 mfa-otp / mfa-oob equivalents).
gaps:
  - No published authentication documentation for developers on any Aaron's property.
  - No API key self-service, no developer portal, no credential request flow.
  - HPP bearer tokens have no documented lifetime, rotation, or scope model.
docs: null
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com