Cyera · Authentication Profile

Cyera Authentication

Authentication

Cyera authenticates API clients with OAuth 2.0 / OpenID Connect against its authorization server at auth.cyera.io. Programmatic/API access uses the client_credentials grant: a Client ID + Client Secret (generated in the Cyera console) are exchanged at the token endpoint for a short-lived JWT bearer token that is then sent as `Authorization: Bearer ` to the API host (api.cyera.io, or the regional api-eu.cyera.io). Integration vendors also document a `/v1/login` convenience endpoint that takes the Client ID + Client Secret and returns the same short-lived JWT. Interactive console/user login uses the authorization_code flow with PKCE (S256).

Cyera secures its APIs with oauth2, openIdConnect, and http across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials, authorizationCode, deviceCode, and tokenExchange flow(s).

CompanyCybersecurityData SecurityDSPMData Security Posture ManagementData ClassificationCloud SecurityComplianceMCPAI Security

Methods: oauth2, openIdConnect, http Schemes: 3 OAuth flows: clientCredentials, authorizationCode, deviceCode, tokenExchange API key in:

Security Schemes

oauth2ClientCredentials oauth2

oauth2AuthorizationCode oauth2

bearerAuth http

scheme: bearer

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: https://auth.cyera.io/.well-known/openid-configuration
docs: https://support.cyera.io/hc/en-us
summary:
  types: [oauth2, openIdConnect, http]
  http_scheme: bearer
  bearer_format: JWT
  oauth2_flows: [clientCredentials, authorizationCode, deviceCode, tokenExchange]
  api_key_in: []
description: >-
  Cyera authenticates API clients with OAuth 2.0 / OpenID Connect against its
  authorization server at auth.cyera.io. Programmatic/API access uses the
  client_credentials grant: a Client ID + Client Secret (generated in the Cyera
  console) are exchanged at the token endpoint for a short-lived JWT bearer
  token that is then sent as `Authorization: Bearer <jwt>` to the API host
  (api.cyera.io, or the regional api-eu.cyera.io). Integration vendors also
  document a `/v1/login` convenience endpoint that takes the Client ID + Client
  Secret and returns the same short-lived JWT. Interactive console/user login
  uses the authorization_code flow with PKCE (S256).
schemes:
- name: oauth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  tokenUrl: https://auth.cyera.io/oauth/token
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post]
  scopes: [openid, profile, email]
  source: https://auth.cyera.io/.well-known/openid-configuration
- name: oauth2AuthorizationCode
  type: oauth2
  flow: authorizationCode
  authorizationUrl: https://auth.cyera.io/oauth/authorize
  tokenUrl: https://auth.cyera.io/oauth/token
  pkce: S256
  scopes: [openid, profile, email]
  source: https://auth.cyera.io/.well-known/openid-configuration
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: Short-lived JWT sent as Authorization Bearer to api.cyera.io.
  source: vendor integration docs (Atlan, Axonius, Swimlane, BlinkOps)
endpoints:
  issuer: https://auth.cyera.io
  authorization_endpoint: https://auth.cyera.io/oauth/authorize
  token_endpoint: https://auth.cyera.io/oauth/token
  userinfo_endpoint: https://auth.cyera.io/identity/resources/users/v2/me
  jwks_uri: https://auth.cyera.io/.well-known/jwks.json
  device_authorization_endpoint: https://auth.cyera.io/oauth/device/authorize
  end_session_endpoint: https://auth.cyera.io/oauth/logout
  grant_types_supported:
  - authorization_code
  - refresh_token
  - client_credentials
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:ietf:params:oauth:grant-type:device_code
  id_token_signing_alg_values_supported: [RS256, ES256]