Digits · Authentication Profile

Digits Authentication

Authentication

Digits secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

AccountingBookkeepingFinancial ReportingGeneral LedgerAIFintechAccountantsBill PayInvoicing
Methods: oauth2 Schemes: 1 OAuth flows: authorizationCode API key in:

Security Schemes

OAuth2 oauth2
· flows: authorizationCode

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://developer.digits.com/docs/authentication
docs: https://developer.digits.com/docs/authentication
summary:
  types: [oauth2]
  oauth2_flows: [authorizationCode]
  pkce: true
  dynamic_client_registration: true
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://connect.digits.com/v1/oauth/authorize
    tokenUrl: https://connect.digits.com/v1/oauth/token
    refresh: true
    parameters:
      response_type: code
      required: [client_id, redirect_uri, scope, state]
  authorization_server_metadata: https://api.digits.com/.well-known/oauth-authorization-server
  metadata:
    issuer: https://api.digits.com
    authorization_endpoint: https://api.digits.com/oauth/authorize
    token_endpoint: https://api.digits.com/oauth/token
    registration_endpoint: https://api.digits.com/oauth/register
    revocation_endpoint: https://api.digits.com/oauth/revoke
    code_challenge_methods_supported: [S256]
    grant_types_supported: [authorization_code, refresh_token]
    token_endpoint_auth_methods_supported: [none, client_secret_post, client_secret_basic]
token_usage:
  scheme: bearer
  header: 'Authorization: Bearer <access_token>'
  revocable: true
notes: >-
  API calls are made against https://connect.digits.com/v1 with a Bearer access token obtained via the
  authorization code grant. Note the developer-docs authorize/token endpoints are on connect.digits.com,
  while the RFC 8414 authorization-server metadata document is published on api.digits.com; both are
  captured above. PKCE (S256) and dynamic client registration are supported.