Door · Authentication Profile

Door Authentication

Authentication

Door secures its APIs with http and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and passwordless flow(s).

CompanyAccess ControlSmart BuildingProptechPhysical SecurityIoTMultifamilyReal EstateSmart LockBuilding Automation
Methods: http, oauth2 Schemes: 3 OAuth flows: clientCredentials, passwordless API key in:

Security Schemes

bearerAuth http
scheme: bearer
partner-m2m oauth2
user-passwordless oauth2

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: openapi/door-partner-openapi.json, openapi/door-authentication-openapi.json
docs: https://developers.door.com/docs/partner-backend.md
summary:
  types:
  - http
  - oauth2
  api_key_in: []
  oauth2_flows:
  - clientCredentials
  - passwordless
model: >-
  OpenDOOR uses Auth0 (auth.prod.latch.com) as its identity provider. DOOR issues each
  partner a unique Auth0 application with two credential sets: partner-scoped (machine-to-machine,
  client_credentials) and user-scoped (passwordless, email verification code). The Partner
  backend exchanges its Client ID/Secret for a JWT; the JWT is presented as a Bearer token
  to the OpenDOOR Partner REST API (rest.latchaccess.com). Tokens are scoped by claims
  (Partner ID, and User ID for user-scoped tokens) rather than by OAuth scope strings.
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  applies_to: openapi/door-partner-openapi.json
  sources:
  - openapi/door-partner-openapi.json
- name: partner-m2m
  type: oauth2
  flow: clientCredentials
  token_url: https://auth.prod.latch.com/oauth/token
  description: >-
    Partner-scoped (machine-to-machine) token for non-user OpenDOOR API calls. Client ID/Secret
    provisioned by DOOR through secure channels; DOOR reserves the right to rotate the secret.
  sources:
  - https://developers.door.com/docs/partner-backend.md
  - openapi/door-authentication-openapi.json
- name: user-passwordless
  type: oauth2
  flow: passwordless
  start_url: https://auth.prod.latch.com/passwordless/start
  token_url: https://auth.prod.latch.com/oauth/token
  description: >-
    User-scoped token obtained via email-based verification code (Auth0 passwordless, connection=email).
    Used to make SDK/API calls on behalf of a provisioned end-user. No user password is collected.
  sources:
  - https://developers.door.com/docs/partner-backend.md
  - openapi/door-authentication-openapi.json
idp:
  provider: Auth0
  issuer: https://auth.prod.latch.com/
  openid_configuration: well-known/door-openid-configuration.json
  jwks_uri: https://auth.prod.latch.com/.well-known/jwks.json