Energyhub Authentication

generated: '2026-07-27'
method: searched
source: live anonymous probes of mec.energyhub.com and help.energyhub.com, plus the
  EnergyHub Mercury Edge Connect announcement
provider_documented: false
provider_documentation_note: |
  EnergyHub publishes no authentication documentation. There is no developer portal, no auth
  guide, no key-issuance page, no OAuth endpoint, and no self-serve credential of any kind on
  any public EnergyHub property. Everything below was established by direct anonymous probing
  of live hosts on 2026-07-27, not from provider documentation. The MEC integration guides
  that would describe authentication live at help.energyhub.com/articles/mec/* behind an
  Okta SSO wall.
summary:
  types: [mutualTLS]
  api_key_in: []
  oauth2_flows: []
  public_credentials: false
  self_serve_signup: false
schemes:
- name: mutualTLS
  type: mutualTLS
  api: energyhub:mercury-edge-connect-api
  host: https://mec.energyhub.com
  status: confirmed-by-probe
  evidence: |
    Every anonymous request to https://mec.energyhub.com - on /, /openapi.json, /swagger.json,
    /docs, /api-docs, /health, /v1, /api, /oadr, and all six /.well-known/* paths - returns
    HTTP/1.1 400 Bad Request with the nginx body "400 No required SSL certificate was sent".
    That is nginx `ssl_verify_client on`: the server demands an X.509 client certificate during
    the TLS handshake and rejects the request before any routing or application logic runs.
    Server certificate: CN=mec.energyhub.com, issuer "C=US, O=DigiCert Inc, CN=RapidSSL TLS RSA
    CA G1", valid 2026-03-17 to 2026-10-01. Re-probed 2026-07-27 22:23 UTC, identical response.
  credential_issuance: EnergyHub issues client certificates to DER partners under a commercial
    partner agreement; there is no public CSR, enrollment, or certificate-request process.
  consistent_with: OpenADR 2.0b VEN/VTN security, which is built on TLS with mutual
    certificate authentication. EnergyHub states the MEC API is "based on the Open ADR
    standard" but does not name a profile or version, so this is a consistency observation,
    not a provider claim.
- name: okta-sso
  type: openIdConnect
  scope: documentation portal only, not the API
  host: https://help.energyhub.com
  status: confirmed-by-probe
  evidence: |
    Every technical article path on the ClickHelp knowledge base returns HTTP 200 with a
    login interstitial titled "Login" carrying a "Log in with Okta SSO" button and an
    authenticator-code (MFA) field - including /articles/mec/mec-overview and
    /articles/technical-guides/technical-guides-overview. No OIDC discovery document is
    exposed (/.well-known/openid-configuration returns the same login HTML, a soft 404),
    so the issuer, endpoints, and scopes cannot be read anonymously.
  note: This gates the documentation, not the runtime API. The ChargingRewards end-user
    guide section of the same portal is public and requires no login.
not_found:
- {scheme: apiKey, note: no API key issuance, header, or query parameter is documented anywhere}
- {scheme: http-basic, note: not offered}
- {scheme: http-bearer, note: not offered}
- {scheme: oauth2, note: no authorization server, token endpoint, or scope reference published}
- {scheme: openIdConnect, note: 'no discovery document on any API host; Okta covers docs SSO only'}
access_gate:
  gate: partner-only
  path: https://www.energyhub.com/der-partner-ecosystem/become-a-partner
  note: A "Connect with us" lead form. There is no published technical criteria, no sandbox,
    and no self-serve credential.