Great West Lifeco Authentication

generated: '2026-07-25'
method: searched
source: >-
  https://developer.empower.com/docs/get-started;
  https://developer.empower.com/docs/additional-security-protocols-publicprivate-key-infrastructure-pki;
  https://developer.empower.com/api-catalog/oauth2-api;
  https://www.empower.com/financial-professionals/experience/apis;
  https://api.canadalife.com/.well-known/openid-configuration (HTTP 200)
docs: https://developer.empower.com/docs/get-started
note: >-
  Great-West Lifeco has no group-wide auth model. Two independent, unrelated
  authorization surfaces exist inside the group and are recorded separately:
  Empower (U.S. retirement) documents its model in prose on a public developer
  portal but issues credentials only after an approved access request, and
  Canada Life (Canada) publishes no documentation at all but does serve a live
  OpenID Connect discovery document on its production API gateway. No OpenAPI
  securitySchemes exist anywhere in the group, so nothing here is derived from
  a spec; every field below was read off a public page or a live probe.
summary:
  types: [apiKey, oauth2, openIdConnect]
  api_key_in: [header]
  api_key_names: [x-api-key]
  oauth2_flows: [clientCredentials]
  client_authentication: [client_secret_basic, private_key_jwt, client_secret_post, client_secret_jwt]
  self_serve_credentials: false
  fapi_alignment: claimed
schemes:
- name: EmpowerApiKey
  entity: Empower (U.S. retirement subsidiary)
  type: apiKey
  in: header
  parameter_name: x-api-key
  source: https://developer.empower.com/docs/get-started
  description: >-
    "The API key is used to protect the Empower API from unauthorized access.
    When your application makes a request to the API, the API key must be
    supplied as a request header named x-api-key with the value of the API key
    delivered." The key is delivered by secure email after an access request is
    reviewed and approved. The OAuth 2.0 API release notes additionally state
    that the /token and /auth endpoints accept an optional x-api-key header.
- name: EmpowerOAuth2ClientCredentials
  entity: Empower (U.S. retirement subsidiary)
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: null
    note: >-
      The authorization service endpoint is not published; it is communicated
      privately to approved partners together with the Client ID and Client
      Secret by secure email. The public OAuth 2.0 API catalog entry documents
      /auth and /token endpoint paths but not their host.
  client_authentication:
  - method: client_secret_basic
    status: legacy
    note: >-
      "Using Type of Basic Auth, set client_credentials as grant_type, Username
      set to your received Client ID, and Password set to your received Client
      secret value. This call will return a bearer access token." Retained only
      for read-only APIs, on individual request and after security review.
  - method: private_key_jwt
    status: required
    since: '2024-Q4'
    note: >-
      "Starting Q4 2024 - in support of higher API security required for
      Financial-grade APIs (FAPI), Empower APIs will be requiring the use
      asymmetric (public-key based) method ... for client authentication
      method." Empower states OAuth2 and OpenID Connect are used to protect its
      APIs, and that asymmetric client authentication means the Empower
      Authorization Server does not need to store sensitive symmetric keys.
  token_usage: >-
    Bearer access token supplied as the value of the Authorization request
    header.
  source: https://developer.empower.com/docs/additional-security-protocols-publicprivate-key-infrastructure-pki
- name: CanadaLifeGatewayOIDC
  entity: Canada Life (Canadian operating brand)
  type: openIdConnect
  openIdConnectUrl: https://api.canadalife.com/.well-known/openid-configuration
  issuer: https://api.canadalife.com
  source: well-known/great-west-lifeco-openid-configuration.json
  endpoints:
    token: https://api.canadalife.com/oauth2/v1/generate
    jwks: https://api.canadalife.com/oauth2/v1/jwks
    revocation: https://api.canadalife.com/oauth2/v1/revoke
    userinfo: https://api.canadalife.com/oauth2/v1/userinfo
    authorization: https://api.canadalife.com/oauth2/v1/authorize-NOT-SUPPORTED
  response_types_supported: [code, token]
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - client_secret_basic
  - client_secret_jwt
  id_token_signing_alg_values_supported: [RS256]
  subject_types_supported: public
  scopes_supported: []
  note: >-
    The authorization_endpoint value is published literally as
    "https://api.canadalife.com/oauth2/v1/authorize-NOT-SUPPORTED", i.e. the
    interactive authorization-code redirect is deliberately disabled and the
    gateway is machine-to-machine only. scopes_supported is an empty array, so
    scope names are provisioned per client rather than advertised. Anonymous
    calls to protected paths return an Apigee error naming the "Consumer-Key",
    confirming an Apigee-fronted gateway. jwks_uri returns live RSA keys
    anonymously (HTTP 200).
gated:
  credentials_issued_by: >-
    Empower: portal registration, then a "Get Access" request per API, reviewed
    and approved, after which API Key, Client ID, Client Secret (or PKI
    onboarding documentation) and the authorization service endpoint arrive by
    secure email. Canada Life: no public request path at all - the gateway
    error envelope points to https://apimarketplace.canadalife.com, a
    digitalML-hosted API marketplace that does not resolve publicly.
  reference_documentation: >-
    Every Empower API reference page states "To see the reference
    documentation, please login". No endpoint list, base URL or specification
    is retrievable anonymously anywhere in the group.
b2c:
  supported: contact-required
  note: '"Contact us to discuss a B2C scenario." - Empower Get started guide.'