AppyWay · Authentication Profile

Appyway Authentication

Authentication

AppyWay secures its APIs with apiKey and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

ParkingTrafficUrban MobilitySmart CitiesEV Charging
Methods: apiKey, oauth2 Schemes: 2 OAuth flows: authorizationCode API key in: header

Security Schemes

apiKey apiKey
· in: header (API-KEY)
oAuth2 oauth2
· flows: authorizationCode

Source

Authentication Profile

Raw ↑ 
generated: '2026-09-04'
method: searched
source: https://docs.appyway.com/docs/public-docs/50055c042f423-authentication, https://docs.appyway.com/docs/public-docs/6465709b0f811-getting-started,
  the four provider-published contracts in github.com/YellowLineParking/Public-Api-Specs, and https://auth.appyway.com/.well-known/openid-configuration
  (fetched 2026-09-04)
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  primary: apiKey
schemes:
- name: apiKey
  type: apiKey
  in: header
  parameter: API-KEY
  sources:
  - openapi/appyway-activitytypes-api-openapi.yml
  - openapi/appyway-authorities-api-openapi.yml
  - openapi/appyway-authoritytypes-api-openapi.yml
  - openapi/appyway-availability-api-openapi.yml
  - openapi/appyway-basemaps-api-openapi.yml
  - openapi/appyway-bulk-api-openapi.yml
  - openapi/appyway-countries-api-openapi.yml
  - openapi/appyway-entitlementtypes-api-openapi.yml
  - openapi/appyway-exceptiontypes-api-openapi.yml
  - openapi/appyway-exemptiontimetypes-api-openapi.yml
  - openapi/appyway-exemptiontypes-api-openapi.yml
  - openapi/appyway-facilitytypes-api-openapi.yml
  - openapi/appyway-fueltypes-api-openapi.yml
  - openapi/appyway-gis-api-openapi.yml
  - openapi/appyway-movingexceptiontypes-api-openapi.yml
  - openapi/appyway-movingrestrictiontypes-api-openapi.yml
  - openapi/appyway-notevisibilitytypes-api-openapi.yml
  - openapi/appyway-offstreetrestrictiontypes-api-openapi.yml
  - openapi/appyway-onstreetparkingtypes-api-openapi.yml
  - openapi/appyway-parking-api-openapi.yml
  - openapi/appyway-paymentmethods-api-openapi.yml
  - openapi/appyway-paymentproviders-api-openapi.yml
  - openapi/appyway-permittedvehicles-api-openapi.yml
  - openapi/appyway-permittypes-api-openapi.yml
  - openapi/appyway-regions-api-openapi.yml
  - openapi/appyway-restrictiontypes-api-openapi.yml
  - openapi/appyway-status-api-openapi.yml
  - openapi/appyway-vehicletypes-api-openapi.yml
  - openapi/appyway-zones-api-openapi.yml
  - openapi/appyway-zonetypes-api-openapi.yml
- name: oAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.appyway.com/authorize
    tokenUrl: https://auth.appyway.com/oauth/token
    scopes: 0
  sources:
  - openapi/appyway-activitytypes-api-openapi.yml
  - openapi/appyway-authorities-api-openapi.yml
  - openapi/appyway-authoritytypes-api-openapi.yml
  - openapi/appyway-availability-api-openapi.yml
  - openapi/appyway-basemaps-api-openapi.yml
  - openapi/appyway-bulk-api-openapi.yml
  - openapi/appyway-countries-api-openapi.yml
  - openapi/appyway-entitlementtypes-api-openapi.yml
  - openapi/appyway-exceptiontypes-api-openapi.yml
  - openapi/appyway-exemptiontimetypes-api-openapi.yml
  - openapi/appyway-exemptiontypes-api-openapi.yml
  - openapi/appyway-facilitytypes-api-openapi.yml
  - openapi/appyway-fueltypes-api-openapi.yml
  - openapi/appyway-gis-api-openapi.yml
  - openapi/appyway-movingexceptiontypes-api-openapi.yml
  - openapi/appyway-movingrestrictiontypes-api-openapi.yml
  - openapi/appyway-notevisibilitytypes-api-openapi.yml
  - openapi/appyway-offstreetrestrictiontypes-api-openapi.yml
  - openapi/appyway-onstreetparkingtypes-api-openapi.yml
  - openapi/appyway-parking-api-openapi.yml
  - openapi/appyway-paymentmethods-api-openapi.yml
  - openapi/appyway-paymentproviders-api-openapi.yml
  - openapi/appyway-permittedvehicles-api-openapi.yml
  - openapi/appyway-permittypes-api-openapi.yml
  - openapi/appyway-regions-api-openapi.yml
  - openapi/appyway-restrictiontypes-api-openapi.yml
  - openapi/appyway-status-api-openapi.yml
  - openapi/appyway-vehicletypes-api-openapi.yml
  - openapi/appyway-zones-api-openapi.yml
  - openapi/appyway-zonetypes-api-openapi.yml
docs: https://docs.appyway.com/docs/public-docs/50055c042f423-authentication
docs_finding: 'AppyWay''s authentication page is unambiguous: "AppyWay authenticates your API requests
  using API keys ... Your API key must be passed with each request in a header. Header name: API-KEY."
  A missing or invalid key returns 401 Unauthorized. Keys are issued by AppyWay on request to apisupport@appyway.com;
  there is no self-serve issuance, no key rotation surface, no scopes and no test key.'
entitlement: Authorisation is scoped per UK local authority rather than per endpoint. A valid key calling
  an authority it is not entitled to receives 403 with a message naming the authority GUID — "No permissions
  to authority '{C5962ED0-1F6A-4417-871A-74E58D921D21}'" (https://docs.appyway.com/docs/public-docs/6465709b0f811-getting-started).
oauth_finding: 'The oAuth2 authorizationCode scheme recorded below was read from an earlier API Evangelist
  harvest of the contracts. AppyWay''s currently published contracts, re-fetched from its own repository
  on 2026-09-04, declare ONLY the apiKey scheme — the oAuth2 block is no longer present in any of the
  four. It is retained here as history, not as a live API auth path. The endpoints it named are real:
  auth.appyway.com is an Auth0 tenant that serves a full OIDC discovery document (well-known/appyway-auth-openid-configuration.json),
  advertising authorization_code, client_credentials, refresh_token, device_code and token-exchange grants
  with S256 PKCE. That tenant is the login for the AppyWay web applications, not the REST API.'
discovery:
  issuer: https://auth.appyway.com/
  openid_configuration: https://auth.appyway.com/.well-known/openid-configuration
  oauth_authorization_server: https://auth.appyway.com/.well-known/oauth-authorization-server
  status: 200
  checked: '2026-09-04'
  saved:
  - well-known/appyway-auth-openid-configuration.json
  - well-known/appyway-auth-oauth-authorization-server.json
  scope: platform login only — the published REST contracts do not accept these tokens
probes:
- url: https://docs.appyway.com/docs/public-docs/50055c042f423-authentication
  status: 200
  checked: '2026-09-04'
- url: https://api.appyway.com/v1/explorer/ping
  status: 401
  checked: '2026-09-04'
  note: anonymous request rejected, confirming the key requirement
- url: https://auth.appyway.com/.well-known/openid-configuration
  status: 200
  checked: '2026-09-04'

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/appyway-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.