Artsy Authentication

generated: '2026-09-07'
method: searched
source: https://developers.artsy.net/v2/docs/authentication
docs: https://developers.artsy.net/v2/docs/authentication
note: >-
  The harvested Swagger 2.0 contract at https://api.artsy.net/api/docs/ declares NO securityDefinitions,
  so derive-authentication.py found nothing to aggregate. This profile is read from the provider's own
  authentication documentation instead, which describes four token mechanisms in prose. Nothing here is
  inferred: every scheme, endpoint, header name and lifetime below is stated on that page.
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, password, custom-oauth_token-exchange]
  spec_declares_security: false
credentials:
  registration: https://developers.artsy.net/v2/docs/getting-started
  console: https://developers.artsy.net/client_applications
  issued: client_id + client_secret, per client application
schemes:
  - name: XappToken
    type: apiKey
    in: header
    parameter_name: X-Xapp-Token
    description: >-
      Anonymous application-level token. Obtained by POSTing client_id and client_secret to
      /api/tokens/xapp_token; the response carries type, token and expires_at. This is the token most
      public-domain read traffic uses — no user account required.
    token_endpoint: https://api.artsy.net/api/tokens/xapp_token
    source_operation: openapi/artsy-public-api-openapi.yml#postApiTokensXappToken
    sources: [https://developers.artsy.net/v2/docs/authentication]
  - name: UserAccessToken
    type: apiKey
    in: header
    parameter_name: X-Auth-Token
    description: >-
      User-scoped token returned by every /oauth2/access_token grant below. Revoked by
      DELETE /api/tokens/access_token.
    revocation_operation: openapi/artsy-public-api-openapi.yml#deleteApiTokensAccessToken
    sources: [https://developers.artsy.net/v2/docs/authentication]
  - name: OAuth2
    type: oauth2
    description: >-
      Artsy acts as an OAuth 2 provider for user login. Redirect URIs are NOT restricted per
      application and the provider states users are prompted to trust the application on every login
      — documented as a known limitation, not a configuration option.
    flows:
      - flow: authorizationCode
        authorizationUrl: https://api.artsy.net/oauth2/authorize
        tokenUrl: https://api.artsy.net/oauth2/access_token
        grant_type: authorization_code
        parameters: [client_id, client_secret, code, grant_type, state, scope]
      - flow: password
        tokenUrl: https://api.artsy.net/oauth2/access_token
        grant_type: credentials
        parameters: [client_id, client_secret, grant_type, email, password, scope]
        note: >-
          Email/password exchange. The provider's own documentation says this is "not recommended".
      - flow: token-exchange
        tokenUrl: https://api.artsy.net/oauth2/access_token
        grant_type: oauth_token
        parameters: [client_id, client_secret, grant_type, oauth_token, oauth_token_secret, oauth_provider]
        note: >-
          Non-standard grant that exchanges a Facebook or Twitter social token for an Artsy token.
          oauth_provider is either "facebook" or "twitter".
    sources: [https://developers.artsy.net/v2/docs/authentication]
token_lifetime:
  default: 60 days
  offline_access: 25 years
  note: >-
    Verbatim from the provider: setting scope to "offline_access" requests a token that expires in
    25 years instead of the standard 60 days. XAPP tokens carry their own expires_at in the response.
error_envelope:
  fields: [error, error_description]
  note: OAuth 2 error code plus a human-readable description, per the authentication page.