AiFi · Authentication Profile

Aifi Authentication

Authentication

AiFi secures its APIs with openIdConnect and oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, implicit, clientCredentials, password, deviceCode, and ciba flow(s).

CompanyComputer VisionRetailAutonomous CheckoutSpatial IntelligenceArtificial IntelligenceAnalyticsIdentityFraud PreventionPoint of Sale
Methods: openIdConnect, oauth2 Schemes: 1 OAuth flows: authorizationCode, implicit, clientCredentials, password, deviceCode, ciba API key in:

Security Schemes

aifi-keycloak openIdConnect

Source

Authentication Profile

aifi-authentication.yml Raw ↑ 
generated: '2026-08-06'
method: probed
source: https://auth.aifi.com/realms/aifi/.well-known/openid-configuration
docs: null
note: >-
  AiFi publishes no public OpenAPI, so no securitySchemes could be derived from a
  spec. This profile is built entirely from the one authentication document AiFi
  does serve anonymously — the OpenID Connect Discovery 1.0 metadata for its
  Keycloak realm `aifi`, saved verbatim at
  well-known/aifi-openid-configuration.json. That realm is the identity provider in
  front of docs.aifi.com (client_id `docs-oidc-client`) and partners.aifi.com. The
  authentication model used by the OASIS retailer APIs themselves is not published
  publicly and is NOT asserted here.
summary:
  types:
  - openIdConnect
  - oauth2
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  - implicit
  - clientCredentials
  - password
  - deviceCode
  - ciba
  spec_derived: false
schemes:
- name: aifi-keycloak
  type: openIdConnect
  openIdConnectUrl: https://auth.aifi.com/realms/aifi/.well-known/openid-configuration
  issuer: https://auth.aifi.com/realms/aifi
  provider: Keycloak
  sources:
  - well-known/aifi-openid-configuration.json
  endpoints:
    authorization: https://auth.aifi.com/realms/aifi/protocol/openid-connect/auth
    token: https://auth.aifi.com/realms/aifi/protocol/openid-connect/token
    userinfo: https://auth.aifi.com/realms/aifi/protocol/openid-connect/userinfo
    jwks: https://auth.aifi.com/realms/aifi/protocol/openid-connect/certs
    introspection: https://auth.aifi.com/realms/aifi/protocol/openid-connect/token/introspect
    revocation: https://auth.aifi.com/realms/aifi/protocol/openid-connect/revoke
    end_session: https://auth.aifi.com/realms/aifi/protocol/openid-connect/logout
    registration: https://auth.aifi.com/realms/aifi/clients-registrations/openid-connect
    device_authorization: https://auth.aifi.com/realms/aifi/protocol/openid-connect/auth/device
    pushed_authorization_request: https://auth.aifi.com/realms/aifi/protocol/openid-connect/ext/par/request
    backchannel_authentication: https://auth.aifi.com/realms/aifi/protocol/openid-connect/ext/ciba/auth
  grant_types:
  - authorization_code
  - implicit
  - refresh_token
  - password
  - client_credentials
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:openid:params:grant-type:ciba
  client_authentication:
  - private_key_jwt
  - client_secret_basic
  - client_secret_post
  - tls_client_auth
  - client_secret_jwt
  capabilities:
    pkce: true
    pkce_methods:
    - plain
    - S256
    par: true
    par_required: false
    mtls_bound_tokens: true
    mtls_endpoint_aliases: true
    backchannel_logout: true
    frontchannel_logout: true
    dynamic_client_registration: true
    request_object_signing: true
    request_uri_registration_required: true
    claims_parameter: true
  id_token_signing_algs:
  - RS256
  - RS384
  - RS512
  - PS256
  - PS384
  - PS512
  - ES256
  - ES384
  - ES512
  - HS256
  - HS384
  - HS512
observed_clients:
- client_id: docs-oidc-client
  host: docs.aifi.com
  scope: openid email profile
  evidence: 302 Location header on https://docs.aifi.com/
x-evidence:
  fetched: '2026-08-06'
  url: https://auth.aifi.com/realms/aifi/.well-known/openid-configuration
  http_status: 200
  content_type: application/json