Australian Taxation Office Authentication

generated: '2026-10-22'
method: searched
source: https://apiportal.ato.gov.au/client-authentication
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: apikey
  description: "API key is assigned when you register to the ATO API Portal.  \n\nSee more details about the registration process in **[Getting started | ATO API Portal](https://apiportal.ato.gov.au/getting-started#toc-how-to-start-using-our-api-portal-services)**."
  sources:
  - openapi/australian-taxation-office-gst-property-settlement-openapi.yml
- name: ScopeAuth
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: '{env}/core2/connect/token'
    scopes: 1
  sources:
  - openapi/australian-taxation-office-gst-property-settlement-openapi.yml
  - openapi/australian-taxation-office-health-check-openapi.yml
  - openapi/australian-taxation-office-oauth-dynamic-client-registration-openapi.yml
  - openapi/australian-taxation-office-stapled-super-fund-openapi.yml
docs: https://apiportal.ato.gov.au/client-authentication
token_endpoints:
  production: https://auth.ato.gov.au/core2/connect/token
  sandbox: https://auth.evte.ato.gov.au/core2/connect/token
grants:
- grant: client_credentials
  for: directly connected software
  client_auth: private_key_jwt (client_assertion_type urn:ietf:params:oauth:client-assertion-type:jwt-bearer), RS256, x5c header with the M2M credential signing certificate
- grant: urn:ietf:params:oauth:grant-type:jwt-bearer (RFC 7523)
  for: online service providers, with a grant JWT when acting on behalf of a business or intermediary
required_headers:
- 'Authorization: Bearer <access token>'
- 'apikey: <consumer key (API key)>'
client_registration: Production client ids are issued per software instance via the OAuth Dynamic Client Registration API (registration scope ato.idp.relyingParties.c), after a registration access token
  is obtained from the ATO SSO/IdP.
credentials: ATO machine-to-machine (M2M) credential keystore; API keys per team application in the ATO API Portal (separate sandbox and production keys).
see_also:
- https://apiportal.ato.gov.au/api-products/oauth-dynamic-client-registration-api