Equifax Authentication

generated: '2026-09-06'
method: searched
source: https://developer.equifax.com/documentation
docs: https://developer.equifax.com/documentation
provider: Equifax
providerId: equifax
description: >-
  Every Equifax API product on the Equifax Developer Portal is protected by OAuth 2.0
  using the client_credentials grant. Credentials (Client ID + Client Secret) are issued
  per application AND per environment when an app is created in the portal and connected
  to one or more API Products. A bearer Access Token obtained from the environment's
  token endpoint must accompany every request; Equifax returns HTTP 401 for a missing or
  invalid token. Production additionally enforces IP allow-listing on top of a valid
  token — a second control that is configured per application in the portal.
schemes:
  - id: oauth2_client_credentials
    type: oauth2
    flow: clientCredentials
    in: header
    header: Authorization
    scheme: Bearer
    token_endpoint: https://api.equifax.com/v2/oauth/token
    token_endpoint_sandbox: https://api.sandbox.equifax.com/v2/oauth/token
    token_endpoint_verified: probed
    token_endpoint_evidence: >-
      An unauthenticated POST of an empty form body (and of grant_type=client_credentials
      alone) to https://api.equifax.com/v2/oauth/token returned HTTP 400 with
      {"error":"invalid_request","error_description":"Missing Mandatory Parameters"} on
      2026-09-06 — an RFC 6749 error response from a live token endpoint, not the
      {"efxErrorCode":"404.01"} envelope the same gateway returns for an unrouted path.
      https://api.sandbox.equifax.com/v2/oauth/token returned the identical body. No
      credentials were sent and none were obtained.
    parameters:
      - client_id
      - client_secret
      - scope
    scopes_documented: false
    scopes_note: >-
      The docs state the token request carries a `scope`, and the quick-start guide tells
      integrators to "Expand each API to confirm the appropriate endpoint 'Scope' to use
      in test mode" — the scope VALUES are per-API-product and are only rendered on the
      signed-in application page in the developer portal. No public scope reference is
      published.
    credentials_scope: per application, per environment
    quote: >-
      "The type of access called 'OAuth 2.0 grant type' used for Equifax APIs is client
      credentials - here the username and password are not required. Rather, you obtain
      the Access Token by providing only the client_id, client_secret, and the scope."
environments:
  - name: Sandbox
    base_url: https://api.sandbox.equifax.com
    credentials: Sandbox Client ID/Secret, or an auto-generated Access Token on the app page
    approval_required: false
  - name: Test (UAT)
    base_url: https://api.uat.equifax.com
    credentials: Test Client ID/Secret, issued after "Promote to Test" approval (typically <48h)
    approval_required: true
  - name: Live (Production)
    base_url: https://api.equifax.com
    credentials: Production Client ID/Secret, issued after a Go Live review
    approval_required: true
    additional_controls:
      - IP allow-listing (IPv4 and IPv6, optional CIDR), configured per application
      - Sectigo TLS certificates must be applied to production and lower environments
additional_credentials:
  - name: Member number / subscriber ID + security code
    applies_to: >-
      Product-level credentials required by some Equifax products in addition to the OAuth
      token (documented for Teletrack in the public quick-start guide).
    source: https://assets.equifax.com/marketing/US/assets/developer-quick-start-guide.PDF
failure_modes:
  - status: 401
    meaning: Missing, invalid, or wrong-environment Access Token; request is not applied.
  - status: 403
    meaning: >-
      Understood but permanently refused — insufficient rights to the resource, or the
      calling gateway IP is not allow-listed for production.
gaps:
  - No /.well-known/openid-configuration or /.well-known/oauth-authorization-server on any
    Equifax host (all 404 — see well-known/equifax-well-known.yml).
  - No public scope reference; scope values require a portal sign-in.
  - No published OpenAPI, so securitySchemes cannot be read from a contract.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com