Cinemark Holdings Authentication

generated: '2026-09-05'
method: searched
source: https://developers.cinemark.com.br/api-portal/node/4
docs: https://developers.cinemark.com.br/api-portal/node/4
note: >-
  There is no OpenAPI, GraphQL SDL or other machine-readable contract anywhere on a
  Cinemark host, so nothing here is derived from a spec. Everything below is read from the
  one auth page the Cinemark Brasil developer portal serves without a login.

  READ THIS CAVEAT BEFORE TRUSTING THE VALUES. The portal is a Sensedia API Portal
  instance that has been branded for Cinemark but largely NOT customised. On the same
  auth page, immediately below the Portuguese app-token section transcribed here, the
  template ships an "OAuth" block whose Request-Token, Authorize and Access-Token
  endpoints are Tumblr's (http://www.tumblr.com/oauth/*). Sibling pages are worse: Terms
  and Conditions (node/3) and FAQ (node/7) are literal Lorem ipsum, "Exemplos" (node/6)
  references a LIPSUM-java-sdk jar, and "Download SDKs" (node/8) is Evernote's SDK page
  copy. Only the app-token section is recorded here; the Tumblr OAuth endpoints are
  recorded as a deviation and are NOT attributed to Cinemark.
confidence: medium
schemes:
  - id: app_token
    type: apiKey
    in: header
    name: App-Token
    description: >-
      Application-level authentication. The portal states that a developer registers an
      application under the portal's APPs menu to obtain an App-Token, then sends that
      token in the header of every request. Verbatim (pt-BR): "Esta API usa somente o
      nivel de autenticacao de aplicacao... Registre seu aplicativo para obter seu
      App-Token no menu APPs... Informe seu App-Token no header de cada requisicao."
    user_level_auth: false
    note: >-
      This is the standard Sensedia API Manager app-token scheme, consistent with the
      Sensedia tenant Cinemark operates at manager-cinemark-prd.sensedia.com. The exact
      header spelling could not be verified against a live call because no API endpoint is
      published and the API Browser is gated.
oauth2: false
openid_connect: false
mutual_tls: false
credential_issuance:
  method: self-service-registration
  url: https://developers.cinemark.com.br/api-portal/user/register
  status: 200
  note: A free developer account can be created; API access beyond that was not tested.
deviations:
  - id: template-oauth-endpoints
    description: >-
      The auth page's OAuth section lists Tumblr's OAuth 1.0a endpoints
      (http://www.tumblr.com/oauth/request_token, /authorize, /access_token) as if they
      were this API's. These are Sensedia demo-template placeholders left in place. They
      are NOT Cinemark endpoints and must never be recorded as such.
gates:
  - url: https://developers.cinemark.com.br/api-portal/apis
    status: 403
    note: >-
      The portal's API list ("Acesso negado") requires an authenticated developer account,
      so the actual security schemes per API could not be read.