Goto Webinar Authentication

generated: '2026-08-13'
method: searched
source: openapi/_original/goto-webinar-openapi.yml
docs:
- https://developer.goto.com/guides/Authentication/03_HOW_accessToken/
- https://developer.goto.com/guides/Authentication/03.1_HOW_accessTokenPAT/
- https://developer.goto.com/guides/Authentication/05_HOW_refreshToken/
- https://developer.goto.com/guides/Authentication/New_Token_Retrieval_Migration_Guide/
- https://developer.goto.com/guides/Get%20Started/02_HOW_createClient/
metadata_document:
  url: https://identity.goto.com/.well-known/oauth-authorization-server
  status: 200
  spec: RFC 8414
  file: well-known/goto-webinar-oauth-authorization-server.json
  alias_host: https://authentication.logmeininc.com/.well-known/oauth-authorization-server
summary:
  types: [oauth2]
  oauth2_flows: [authorizationCode, password]
  api_key_in: []
  bearer: true
  issuer: https://identity.goto.com
  pkce: [S256]
  scope: 'collab:'
schemes:
- name: OAuth2
  type: oauth2
  in: header
  header: Authorization
  scheme: Bearer
  description: >-
    To use this API you must provide an OAuth token requested from GoTo's
    authorization server. The spec's own description still points at the legacy
    LogMeIn documentation URL; the current guides live under
    developer.goto.com/guides/Authentication/.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://identity.goto.com/oauth/authorize
    tokenUrl: https://identity.goto.com/oauth/token
    refreshUrl: https://identity.goto.com/oauth/token
    spec_declares:
      authorizationUrl: https://authentication.logmeininc.com/oauth/authorize
      tokenUrl: https://authentication.logmeininc.com/oauth/token
    pkce: S256
    scopes: 0
    note: >-
      The recommended flow. The OpenAPI names authentication.logmeininc.com;
      the RFC 8414 metadata served at that exact host reports issuer
      https://identity.goto.com and lists identity.goto.com endpoints, so both
      hostnames front one authorization server mid-rename. GoTo publishes a
      migration guide for the transition.
  - flow: password
    tokenUrl: https://identity.goto.com/oauth/token
    refreshUrl: https://identity.goto.com/oauth/token
    scopes: 0
    deprecated: true
    note: >-
      "Direct Login". GoTo's SDK guides state "This authentication API is now
      deprecated. All new clients will not be able to use this API. If you have
      a client for which the direct login works, that will continue to work for
      now." It is still declared in the live contract — the spec advertises a
      grant the docs bar new clients from using. GoTo publishes a Direct Login
      migration guide at /guides/References/05_Direct-Login_migration/.
  sources:
  - openapi/_original/goto-webinar-openapi.yml
  - openapi/goto-webinar-webinars-api-openapi.yml
  - openapi/goto-webinar-sessions-api-openapi.yml
  - openapi/goto-webinar-registrants-api-openapi.yml
  - openapi/goto-webinar-attendees-api-openapi.yml
  - openapi/goto-webinar-panelists-api-openapi.yml
  - openapi/goto-webinar-co-organizers-api-openapi.yml
  - openapi/goto-webinar-recordingassets-api-openapi.yml
  - openapi/goto-webinar-webhooks-api-openapi.yml
endpoints:
  authorization: https://identity.goto.com/oauth/authorize
  token: https://identity.goto.com/oauth/token
  introspection: https://identity.goto.com/oauth/introspect
  revocation: https://identity.goto.com/oauth/revoke
  jwks: https://identity.goto.com/oauth/jwks.json
  client_management: https://developer.logmeininc.com/clients
supported:
  response_types: [code]
  grant_types: [authorization_code, refresh_token]
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
  code_challenge_methods: [S256]
  client_id_metadata_document: true
  source: https://identity.goto.com/.well-known/oauth-authorization-server
personal_access_tokens:
  supported: true
  docs: https://developer.goto.com/guides/Authentication/03.1_HOW_accessTokenPAT/
  note: >-
    GoTo publishes a guide for obtaining an OAuth access token using a Personal
    Access Token — the low-friction path for scripts and back-office
    integrations that do not need a user-consent redirect.
refresh_tokens:
  supported: true
  docs: https://developer.goto.com/guides/Authentication/05_HOW_refreshToken/
  note: The token response includes a refresh token; refresh_token is a declared grant type.
runtime_behaviour:
  auth_failure_status: 403
  note: >-
    No operation in the contract declares 401. Authentication and authorization
    failures both surface as 403, so token-refresh logic keyed on 401 will never
    fire against this API.
gaps:
- No OpenID Connect discovery document (/.well-known/openid-configuration 404s on every GoTo host) — this is plain OAuth 2.0, no id_token.
- No RFC 9728 OAuth Protected Resource metadata at the API host (api.getgo.com 404s).
- No per-operation scopes. The whole API is guarded by one product-level scope, so an agent token cannot be least-privileged. See scopes/goto-webinar-scopes.yml.