Aflac Authentication

generated: '2026-09-04'
method: searched
source: >-
  https://docs.enterprise-connect.aflac.com/docs/developer-guide/how-to-guides/how-to-make-a-request-to-aec-using-postman
  and .../how-to-make-a-request-using-swagger, .../how-to-deploy-a-new-service/things-to-set-up-prerequisite-tasks,
  .../how-to-encrypt-and-decrypt, .../how-to-use-certificates — read from the Aflac Enterprise
  Connect portal's public content index /assets/ng-doc/indexes.json (HTTP 200, 2026-09-04).
  Upgrades the derived profile that was computed from openapi/_ae-authored/ scaffolds.
docs: https://docs.enterprise-connect.aflac.com/docs/developer-guide/how-to-guides/how-to-make-a-request-to-aec-using-postman
provider: aflac
summary:
  types:
  - oauth2
  oauth2_flows:
  - clientCredentials
  exclusive: true
  statement: >-
    "How can I make requests to AEC without using OAuth 2.0? Put simply - you cannot. OAuth 2.0 is
    the only supported method for authenticating requests to AEC."
schemes:
- name: oauth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: null
    tokenUrl_note: >-
      NOT PUBLISHED ANONYMOUSLY. The Postman guide links an internal "Access Token URLs" page that
      the public content index does not carry. The value previously recorded here —
      https://auth.enterprise-connect.aflac.com/oauth/token — came from an API Evangelist-authored
      scaffold and is not a real host: DNS for auth.enterprise-connect.aflac.com returns NXDOMAIN
      (checked 2026-09-04). It has been removed rather than carried forward.
    scopes_published: false
  header: Authorization
  prefix: Bearer
  client_authentication: HTTP Basic — client_id and client_secret sent as a Basic auth header
  identity_provider: PingIdentity
  credential_issuance: >-
    Internal ServiceNow request to the Security team ("oAuth / Ping Client Credential Request").
    There is no self-serve or public signup path for AEC credentials.
  description: >-
    OAuth 2.0 client-credentials is the sole authentication method into the AEC API gateway. Aflac
    documents the full Postman setup: type OAuth 2.0, auth data added to request headers, header
    prefix Bearer, auto-refresh off, client authentication sent as a Basic auth header.
  sources:
  - https://docs.enterprise-connect.aflac.com/docs/developer-guide/how-to-guides/how-to-make-a-request-to-aec-using-postman
  - https://docs.enterprise-connect.aflac.com/docs/developer-guide/how-to-guides/how-to-make-a-request-using-swagger

additional_headers:
- header: aflac-openid-token
  required: conditional
  description: >-
    Documented alongside the OAuth 2.0 header on the a-cipher aspect service — "send POST request
    to /a-cipher-1/v1/cipher-actions/protect with the appropriate OAuth 2.0 and aflac-openid-token
    headers depending on environment". A second, user-identity-bearing token distinct from the
    machine client-credentials token.
  source: https://docs.enterprise-connect.aflac.com/docs/developer-guide/how-to-guides/how-to-encrypt-and-decrypt

transport_security:
  mtls_inbound_required: false
  note: >-
    "In AEC, you no longer need to use Mutual TLS (mTLS) to make requests to the running service in
    AEC." mTLS remains in use for egress to third parties that enforce it and for legacy EIB 1.0
    (Akana) systems; those certificates are managed through Venafi and injected into service
    keystores automatically.
  service_to_service: >-
    Services inside AEC communicate directly across the service mesh without going back out through
    the AWS API Gateway and without per-call certificates.

portal_authentication:
  provider: PingIdentity
  federation: >-
    Portal login in non-production uses an environment-suffixed identity — rmurphy@aflac.com becomes
    rmurphy@aflacdev.com or rmurphy@aflacqa.com; a new PING profile may be required on first login.
  saml_sso: Used for the Cloudsmith artifact registry (organization tag aflac-prod), not for the API.

gate:
  self_serve: false
  public_signup: false
  note: >-
    Every path to an AEC credential runs through an internal Aflac ServiceNow request. A member of
    the public can read the platform's design rules in full but cannot obtain a token.

anonymous_probe:
  url: https://enterprise-connect.aflac.com/
  status: 403
  body: '{"message":"Forbidden"}'
  checked: '2026-09-04'