Equipmentshare Authentication

generated: '2026-07-19'
method: searched
source: https://github.com/EquipmentShare/t3os-examples
docs: https://github.com/EquipmentShare/t3os-examples
# T3OS (the EquipmentShare developer platform, es-erp-api) publishes three first-party auth
# flows, documented end-to-end in the MIT-licensed t3os-examples reference apps and backed by
# a production Auth0 tenant. Verified live: the Auth0 OIDC discovery document and the es-erp-api
# JWKS endpoint both return 200 (see well-known/).
summary:
  types: [oauth2, apiKey, openIdConnect]
  api_key_in: [header]
  api_key_header: X-API-Key
  oauth2_flows: [authorizationCode]
  pkce: required
  identity_provider: Auth0
  auth0_tenant: equipmentshare-erp.us.auth0.com
  auth0_tenant_staging: staging-equipmentshare-erp.us.auth0.com
schemes:
- name: T3OS OAuth2 (user-delegated)
  type: oauth2
  description: >-
    User-delegated access. The user signs in via T3OS, selects a workspace at the consent
    screen, and the app receives a Bearer access token scoped to that user. Authorization Code
    + PKCE, no client SDK required. Sent as `Authorization: Bearer <token>` to the GraphQL API.
  flows:
  - flow: authorizationCode
    pkce: true
    authorizationUrl: https://equipmentshare-erp.us.auth0.com/authorize
    tokenUrl: https://equipmentshare-erp.us.auth0.com/oauth/token
    logoutUrl: https://equipmentshare-erp.us.auth0.com/v2/logout
    audience: https://api.equipmentshare.com/es-erp-api/delegated
  claims:
    uid: https://es-erp/uid
    workspace: workspace_id
  sources: [https://github.com/EquipmentShare/t3os-examples/tree/main/apps/oauth-hello-world]
- name: T3OS Workspace-installed API Key
  type: apiKey
  in: header
  parameter_name: X-API-Key
  description: >-
    Unattended, workspace-scoped access for syncs, exports, scheduled jobs and webhooks. A
    workspace admin installs the app once (installWorkspaceApp); T3OS mints a principal, creates
    a workspace-scoped API key, and signs an install-token JWT delivered to the app's
    installCallbackUrl. The JWT is verified against the es-erp-api JWKS; the API key is then sent
    as `X-API-Key` on GraphQL calls. Keys do not expire and are invalidated only on uninstall.
  install_token:
    issuer: https://api.equipmentshare.com/es-erp-api
    jwks_uri: https://api.equipmentshare.com/es-erp-api/.well-known/jwks.json
  sources: [https://github.com/EquipmentShare/t3os-examples/tree/main/apps/workspace-hello-world]
- name: T3OS OpenID Connect (sign-in only)
  type: openIdConnect
  openIdConnectUrl: https://equipmentshare-erp.us.auth0.com/.well-known/openid-configuration
  description: >-
    Pure "Sign in with T3OS" identity — no workspace selection, no API access. T3OS acts as an
    OIDC identity provider; the third-party app keys its own user table off the
    `https://es-erp/uid` claim.
  sources: [https://github.com/EquipmentShare/t3os-examples/tree/main/apps/oidc-hello-world]
notes: >-
  App registration/lifecycle is managed through T3OS management operations (registerApp,
  updateApp, installWorkspaceApp) and the T3OS dev portal at https://app.t3os.ai, where
  clientSecret and workspace API keys can be rotated.