Canadian Tire Bank · Authentication Profile

Canadian Tire Bank Authentication

Authentication

Canadian Tire Bank secures its APIs with oauth2 and openIdConnect across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, implicit, and refreshToken flow(s).

Financial ServicesBankingCanadaSchedule I BankCredit CardsMastercardConsumer-Driven BankingData Aggregation
Methods: oauth2, openIdConnect Schemes: 2 OAuth flows: authorizationCode, implicit, refreshToken API key in:

Security Schemes

openIdConnect openIdConnect
OAuth2 oauth2
· flows: authorizationCode, implicit

Source

Authentication Profile

canadian-tire-bank-authentication.yml Raw ↑ 
generated: '2026-07-23'
method: searched
source: https://www.ctfs.com/.well-known/openid-configuration
docs: https://api.ctfs.com/apidocs/auth/oauth/v2/swagger  # HTTP 503 at probe time (2026-07-23)
notes: >-
  Derived from the bank's anonymously-published OpenID Connect discovery
  document. This is a CONSUMER-facing OAuth2/OIDC authorization server (Triangle
  cardmember / account sign-in), not a documented public developer/banking API.
  The scopes advertised (openid, email, profile) confirm a login/identity surface
  rather than a data-access API. The issuer host api.ctfs.com returned HTTP 503 on
  every probe, so token/authorize endpoints could not be exercised.
summary:
  types: [oauth2, openIdConnect]
  oauth2_flows: [authorizationCode, implicit, refreshToken]
  oidc_issuer: https://api.ctfs.com
  dynamic_client_registration: true    # registration_endpoint present (RFC 7591)
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt]
schemes:
- name: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://www.ctfs.com/.well-known/openid-configuration
  issuer: https://api.ctfs.com
  authorization_endpoint: https://api.ctfs.com:443/auth/oauth/v2/authorize
  token_endpoint: https://api.ctfs.com:443/auth/oauth/v2/token
  userinfo_endpoint: https://api.ctfs.com:443/openid/connect/v1/userinfo
  jwks_uri: https://api.ctfs.com:443/openid/connect/jwks.json
  registration_endpoint: https://api.ctfs.com:443/openid/connect/register
  id_token_signing_alg_values_supported: [RS256, HS256]
  subject_types_supported: [pairwise]
  sources: [well-known/canadian-tire-bank-openid-configuration.json]
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.ctfs.com:443/auth/oauth/v2/authorize
    tokenUrl: https://api.ctfs.com:443/auth/oauth/v2/token
  - flow: implicit
    authorizationUrl: https://api.ctfs.com:443/auth/oauth/v2/authorize
  grant_types_supported: [authorization_code, implicit, refresh_token]
  response_types_supported: [code, "token id_token", token, "code id_token", id_token, "code token", "code id_token token"]
  response_modes_supported: [query, fragment, form_post]
  sources: [well-known/canadian-tire-bank-openid-configuration.json]