Capital One · Authentication Profile

Capital One Authentication

Authentication

Capital One secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

Auto FinanceAuthorizationsBankingCredit CardsCredit OffersDevExchangeFinancial ServicesFDXOpen BankingOAuth 2.0PaymentsRewardsUnited StatesFortune 500

Methods: oauth2 Schemes: 1 OAuth flows: clientCredentials API key in:

Security Schemes

OAuth2 oauth2

· flows: clientCredentials

Source

Authentication Profile

generated: '2026-07-23'
method: searched
source: https://developer.capitalone.com/documentation/o-auth
docs: https://developer.capitalone.com/documentation/o-auth
notes: >-
  Capital One does not publish a downloadable OpenAPI, so this profile is
  captured from the DevExchange OAuth documentation rather than derived from
  securitySchemes. All DevExchange partner APIs are secured with OAuth 2.0.
  Access to production is gated behind partner approval; the sandbox
  (api-sandbox.capitalone.com) is used for pre-production integration.
summary:
  types: [oauth2]
  oauth2_flows: [clientCredentials]
  token_type: Bearer
  transport: header
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.capitalone.com/oauth2/token
    sandbox_tokenUrl: https://api-sandbox.capitalone.com/oauth2/token
    note: >-
      Client credentials grant. Partners obtain a client_id / client_secret via
      the DevExchange program and exchange them for a short-lived bearer token
      presented on each API call as `Authorization: Bearer <token>`.
  sources: [https://developer.capitalone.com/documentation/o-auth]
related:
- product: Data Protection and Client Authentication Public Key Sharing API
  role: >-
    Supporting security primitive — clients exchange public keys with Capital
    One to establish encrypted, authenticated communication for sensitive data
    in transit, complementing the OAuth 2.0 bearer model.