British Airways Authentication

generated: '2026-07-28'
method: searched
source: >-
  https://baexternalid.ciamlogin.com/45c0456f-2aef-40f6-847e-d3d957348527/v2.0/.well-known/openid-configuration
  (fetched 2026-07-28, HTTP 200); https://ndc.ba.com/main.7a41cb6e4d2487f7.js (MSAL
  configuration in the NDC hub application bundle); archived IAG Developer Programs portal
  pages for the retired public REST API and the NDC certification flow.
description: >-
  British Airways publishes no OpenAPI, so no securityScheme could be derived mechanically.
  This profile was assembled from the two authentication surfaces that are actually observable:
  the OpenID Connect discovery document of the Microsoft Entra External ID (CIAM) tenant that
  the NDC Communication Hub logs developers into, and the archived documentation for the
  client-key credential the NDC and legacy REST APIs consume. The hub login and the API
  credential are separate things — logging into ndc.ba.com does not grant API access; a
  client-key is issued disabled and only enabled through certification and a signed contract.
summary:
  types: [openIdConnect, apiKey]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, implicit, deviceCode]
  self_serve: false
  gate: commercial-agreement
schemes:
  - name: EntraExternalID
    type: openIdConnect
    applies_to: >-
      Developer/partner login to the British Airways NDC Communication Hub (ndc.ba.com) — its
      documentation, sandbox screens and registration flows. Not the NDC message API itself.
    openIdConnectUrl: https://baexternalid.ciamlogin.com/45c0456f-2aef-40f6-847e-d3d957348527/v2.0/.well-known/openid-configuration
    issuer: https://45c0456f-2aef-40f6-847e-d3d957348527.ciamlogin.com/45c0456f-2aef-40f6-847e-d3d957348527/v2.0
    tenant_id: 45c0456f-2aef-40f6-847e-d3d957348527
    tenant_region_scope: EU
    provider: Microsoft Entra External ID (CIAM)
    client_library: MSAL (bundled in the hub's Angular application)
    endpoints:
      authorization: https://baexternalid.ciamlogin.com/45c0456f-2aef-40f6-847e-d3d957348527/oauth2/v2.0/authorize
      token: https://baexternalid.ciamlogin.com/45c0456f-2aef-40f6-847e-d3d957348527/oauth2/v2.0/token
      device_authorization: https://baexternalid.ciamlogin.com/45c0456f-2aef-40f6-847e-d3d957348527/oauth2/v2.0/devicecode
      end_session: https://baexternalid.ciamlogin.com/45c0456f-2aef-40f6-847e-d3d957348527/oauth2/v2.0/logout
      jwks: https://baexternalid.ciamlogin.com/45c0456f-2aef-40f6-847e-d3d957348527/discovery/v2.0/keys
      userinfo: https://graph.microsoft.com/oidc/userinfo
      mtls_token: https://mtlsauth.microsoft.com/45c0456f-2aef-40f6-847e-d3d957348527/oauth2/v2.0/token
    response_types_supported: [code, id_token, code id_token, id_token token]
    response_modes_supported: [query, fragment, form_post]
    token_endpoint_auth_methods_supported:
      - client_secret_post
      - private_key_jwt
      - client_secret_basic
      - self_signed_tls_client_auth
    id_token_signing_alg_values_supported: [RS256]
    subject_types_supported: [pairwise]
    tls_client_certificate_bound_access_tokens: true
    scopes: [openid, profile, email, offline_access]
    scopes_artifact: scopes/british-airways-scopes.yml
    frontchannel_logout_supported: true
  - name: client-key
    type: apiKey
    in: header
    parameter_name: client-key
    applies_to: >-
      The British Airways API credential. Documented for the retired public REST API
      ("Your unique key used to authorise access to the API") and carried forward as the
      credential issued at NDC registration ("Issue a new key for Shop and Order - test").
    issuance: >-
      Issued on registration in a disabled state. Enabled for test only after the British
      Airways API and Services Trial Use Agreement is accepted, and for live only after B1 or
      B2 certification is passed and Live API Contracts are signed by both parties — live
      access follows within 5 working days of countersignature.
    source: >-
      https://web.archive.org/web/20211202/https://developer.iairgroup.com/british_airways/ApiInfo
      and https://web.archive.org/web/20210303183958/https://developer.iairgroup.com/british_airways/plans/ndc_certification
    status: >-
      The public REST API this key was documented against is decommissioned (api.ba.com returns
      ERR_596_SERVICE_NOT_FOUND). For NDC the credential model is described but no production
      host, header specification or token exchange is published.
ndc_api_authentication:
  published: false
  note: >-
    British Airways publishes no authentication specification for the NDC message API itself.
    No production base URL, no WSDL, no OpenAPI and no securityScheme are in the public domain.
    What is documented is the process by which credentials are granted, not the wire format.
    Anything more specific would be fabrication.
access_gate:
  self_serve: false
  value: commercial-agreement
  steps:
    - Register via https://ndc.ba.com/start/ndc-registrations and the NDC ServiceDesk
    - Accept the British Airways API and Services Trial Use Agreement
    - Receive a client-key, initially disabled
    - Complete a B1 (direct) or B2 (via an NDC Service Provider) Certification Form
    - Accept the Travel Agency Addendum if an IATA accredited agent
    - Build and demonstrate successful test bookings against the test environment
    - Sign Live API Contracts, tailored to business activity, countersigned by British Airways
  docs:
    - https://ndc.ba.com/start/ndc-registrations
    - https://ndc.ba.com/start/build-and-test-the-api
    - https://ndc.ba.com/start/get-certified-and-go-live
related:
  - scopes/british-airways-scopes.yml
  - well-known/british-airways-well-known.yml
  - conformance/british-airways-conformance.yml
  - sandbox/british-airways-sandbox.yml