Authlete · Authentication Profile

Authlete Authentication

Authentication

Authlete secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyOAuth 2.0OpenID ConnectAuthenticationAuthorizationIdentityAPI SecurityFAPIVerifiable CredentialsCIBA

Methods: http Schemes: 1 OAuth flows: API key in:

Security Schemes

bearer http

scheme: bearer

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: openapi/authlete-openapi-original.yml
docs: https://docs.authlete.com/
permissions_model: >-
  Access tokens are minted in the Authlete console (or provisioning APIs) with permission
  strings that gate which operations they may call, e.g. service.read, service.write,
  client.read, client.write. Service Access Tokens are limited to one service; Organization
  Tokens inherit permissions across all services in the organization.
summary:
  types:
  - http
schemes:
- name: bearer
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: |-
    Authenticate every request with a **Service Access Token** or **Organization Token**.
    Set the token value in the `Authorization: Bearer <token>` header.

    **Service Access Token**: Scoped to a single service. Use when automating service-level configuration or runtime flows.

    **Organization Token**: Scoped to the organization; inherits permissions across services. Use for org-wide automation or when
  sources:
  - openapi/authlete-openapi-original.yml