Anywhere Real Estate Authentication

generated: '2026-07-26'
method: searched
source: https://developers.anywhere.re/docs/realogy-oauth
docs: https://developers.anywhere.re/docs/realogy-oauth
supporting_sources:
- https://developers.anywhere.re/blog/test-anywhere-apis-postman-collection
- https://developers.anywhere.re/blog/generate-bearer-token-using-api-credentials
- https://developers.anywhere.re/blog/api-key-rotation-user-guide
- authentication/anywhere-real-estate-okta-prod-authorization-server.json
- authentication/anywhere-real-estate-okta-prod-openid-configuration.json
- authentication/anywhere-real-estate-okta-nonprod-authorization-server.json
summary:
  types: [oauth2, apiKey]
  api_key_in: [header]
  api_key_name: apiKey
  oauth2_flows: [clientCredentials]
  dual_credential: true
  note: >-
    Every call to an Anywhere API requires BOTH credentials — an Anywhere-issued API
    key in the apiKey header AND an Okta-issued OAuth 2.0 bearer token obtained with
    the client_credentials grant. Neither alone is sufficient. The two credentials do
    different jobs, stated verbatim in the OAuth guide: "API keys identify the calling
    application and make the call to an API. Authentication tokens identify a user that
    is using the application."
identity_provider:
  vendor: Okta
  production_org: https://realogy.okta.com
  non_production_org: https://realogy.oktapreview.com
  federation: >-
    Developer Portal release 1.3.30 (February 5, 2026) added federated authentication
    with Compass Okta for Compass internal users, following the January 9, 2026
    combination of Anywhere Real Estate and Compass.
schemes:
- name: AnywhereApiKey
  type: apiKey
  in: header
  parameter_name: apiKey
  description: >-
    Anywhere-issued API key, provisioned per application per environment from the
    developer portal Dashboard > My Apps. Verbatim from the OAuth guide - "Every call
    to the APIs requires an API Key. This key must be passed in the request header as
    apiKey."
  issued_by: developer portal (My Apps), after Anywhere approval
  rotation:
    supported: true
    expires: true
    renewal_window_days: 45
    notes: >-
      API keys expire. The portal exposes a Renew Key action 45 days before expiry and
      sends an automated email; renewal is only possible up to the day of expiry.
      Anywhere ships a dual-mode API Key Rotation engine with downloadable toolkits for
      AWS (Lambda extension layer), Azure, local/on-prem and a manual path.
    docs: https://developers.anywhere.re/blog/api-key-rotation-user-guide
  sources: [https://developers.anywhere.re/docs/realogy-oauth]
- name: AnywhereOAuth2
  type: oauth2
  flow: clientCredentials
  grant_type: client_credentials
  token_endpoint_production: https://realogy.okta.com/oauth2/aus7i8b1taFyPOEGc1t7/v1/token
  token_endpoint_non_production: https://realogy.oktapreview.com/oauth2/ausdtpyw647fbrcPi0h7/v1/token
  authorization_endpoint_production: https://realogy.okta.com/oauth2/aus7i8b1taFyPOEGc1t7/v1/authorize
  jwks_uri_production: https://realogy.okta.com/oauth2/aus7i8b1taFyPOEGc1t7/v1/keys
  introspection_endpoint_production: https://realogy.okta.com/oauth2/aus7i8b1taFyPOEGc1t7/v1/introspect
  revocation_endpoint_production: https://realogy.okta.com/oauth2/aus7i8b1taFyPOEGc1t7/v1/revoke
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  - client_secret_jwt
  - private_key_jwt
  - none
  code_challenge_methods_supported: [S256]
  client_credentials_delivery: >-
    The Postman walkthrough instructs developers to send the client credentials as HTTP
    Basic Auth (Okta Client ID as username, Client Secret as password) with a
    x-www-form-urlencoded body carrying grant_type=client_credentials and scope; the
    OAuth guide's own Postman steps say to send client credentials in the body. Both
    client_secret_basic and client_secret_post are advertised by the authorization
    server.
  response_fields: [access_token, token_type, expires_in, scope]
  token_type: bearer
  request_header: 'Authorization: Bearer {access_token}'
  sources:
  - https://developers.anywhere.re/docs/realogy-oauth
  - authentication/anywhere-real-estate-okta-prod-authorization-server.json
scopes:
  model: App ID URI
  reference: scopes/anywhere-real-estate-scopes.yml
  caution: >-
    Anywhere scopes are App ID URIs, not URLs to call. The OAuth guide warns verbatim
    "The App ID URI is a unique identifier for the REST API. It is not where the REST
    API is hosted." REST API URLs are communicated separately per environment after
    approval.
  assignment: >-
    "Scope: Will be communicated in the final approval" — scopes are granted per
    approved application, not self-selected.
operational_rules:
- rule: mandatory token caching
  text: >-
    Verbatim - "All access tokens have an expiration and must be cached by the
    application within 5 minutes of expiration. Applications who fail to cache their
    access tokens and request new access tokens for every REST API call they make will
    have their access immediately suspended."
  enforcement: immediate suspension
- rule: client secret handling
  text: >-
    Verbatim - "Always store the client secret key securely... This should never be
    stored in a Mobile App or Native App." A replacement secret can be requested on
    suspected compromise.
- rule: separate credentials per application
  text: >-
    Verbatim - "Each client application must have separate credentials set and the API
    Key."
- rule: separate credentials per environment
  text: >-
    Sandbox and production are independently approved and independently credentialed;
    each approval takes up to 2 business days.
observed:
- probe: https://api.anywhere.re/mls/v1
  status: 401
  body: '{"statusCode":401,"message":"Failed to resolve API Key variable apiKey"}'
  note: >-
    The gateway rejects an anonymous call on the API-key check before it ever evaluates
    the bearer token, confirming apiKey is enforced at the Apigee layer.
  date: '2026-07-26'
gaps:
- No mutualTLS, no openIdConnect discovery advertised on the API gateway itself.
- No public OpenAPI, so securitySchemes cannot be verified per operation; this profile
  is built entirely from the anonymously published OAuth guide plus harvested Okta
  discovery documents.