Gsma Authentication

generated: '2026-07-25'
method: searched
source: openapi/gsma-open-gateway-call-forwarding-signal-openapi.yml, openapi/gsma-open-gateway-carrier-billing-openapi.yml,
  openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml, openapi/gsma-open-gateway-device-identifier-openapi.yml,
  openapi/gsma-open-gateway-device-location-retrieval-openapi.yml, openapi/gsma-open-gateway-device-location-verification-openapi.yml,
  openapi/gsma-open-gateway-device-reachability-status-openapi.yml, openapi/gsma-open-gateway-device-roaming-status-openapi.yml,
  openapi/gsma-open-gateway-device-swap-openapi.yml, openapi/gsma-open-gateway-home-devices-quality-on-demand-openapi.yml,
  openapi/gsma-open-gateway-know-your-customer-openapi.yml, openapi/gsma-open-gateway-number-verification-openapi.yml
  ...
summary:
  types:
  - http
  - openIdConnect
  - unknown
schemes:
- name: openId
  type: openIdConnect
  openIdConnectUrl: https://example.com/.well-known/openid-configuration
  description: to support Consent Management
  sources:
  - openapi/gsma-open-gateway-call-forwarding-signal-openapi.yml
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml
  - openapi/gsma-open-gateway-device-identifier-openapi.yml
  - openapi/gsma-open-gateway-device-location-retrieval-openapi.yml
  - openapi/gsma-open-gateway-device-location-verification-openapi.yml
  - openapi/gsma-open-gateway-device-reachability-status-openapi.yml
  - openapi/gsma-open-gateway-device-roaming-status-openapi.yml
  - openapi/gsma-open-gateway-device-swap-openapi.yml
  - openapi/gsma-open-gateway-home-devices-quality-on-demand-openapi.yml
  - openapi/gsma-open-gateway-know-your-customer-openapi.yml
  - openapi/gsma-open-gateway-number-verification-openapi.yml
  - openapi/gsma-open-gateway-otp-validation-openapi.yml
  - openapi/gsma-open-gateway-population-density-data-openapi.yml
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml
  - openapi/gsma-open-gateway-simple-edge-discovery-openapi.yml
- name: notificationsBearerAuth
  type: http
  scheme: bearer
  bearerFormat: '{$request.body#/sinkCredential.credentialType}'
  sources:
  - openapi/gsma-open-gateway-carrier-billing-openapi.yml
  - openapi/gsma-open-gateway-carrier-billing-refund-openapi.yml
  - openapi/gsma-open-gateway-population-density-data-openapi.yml
  - openapi/gsma-open-gateway-quality-on-demand-openapi.yml
- name: openId
  type: unknown
  sources:
  - openapi/gsma-open-gateway-sim-swap-openapi.yml
docs:
- https://open-gateway.gsma.com/sandbox
- https://developer.mobilemoneyapi.io/security/
- https://developer.mobilemoneyapi.io/sdks/auth/client-authentication.html
note: 'Derived from the eighteen harvested specifications, then upgraded from the provider''s own documentation. Two
  independent models. (1) GSMA Open Gateway / CAMARA: every one of the 17 specs declares a single openIdConnect scheme
  named ''openId'' and attaches CAMARA scopes per operation; four specs additionally declare notificationsBearerAuth
  (http bearer) for the CloudEvents callback sink. The GSMA issues no tokens — the authorization server is always the
  operator''s or the aggregator''s, and the openIdConnectUrl published in every spec is the CAMARA placeholder https://example.com/.well-known/openid-configuration.
  The sim-swap spec''s scheme carries no type key, which is why the derived summary lists an ''unknown'' type. (2) GSMA
  Mobile Money API: the OpenAPI declares no securitySchemes at all; credentials travel as headers.'
programmes:
- programme: GSMA Open Gateway (CAMARA)
  model: OpenID Connect, per-operation scopes
  token_issuer: operator or aggregator authorization server (never the GSMA)
  flows_named_by_gsma_sandbox:
  - flow: client_credentials
    live_deployments: 256
    certified: 49
  - flow: authorization_code
    live_deployments: 190
    certified: 58
  - flow: CIBA
    live_deployments: 94
    certified: 57
    note: Client Initiated Backchannel Authentication; the Number Verification spec describes passing a GSMA TS.43 temporary
      token via login_hint=operatortoken:<token>
  - flow: jwt_bearer
    live_deployments: 7
    certified: 1
  flow_counts_source: https://d3bj8knxlstxyw.cloudfront.net/assets-map-launches.json
  discovery_probes:
  - url: https://open-gateway.gsma.com/.well-known/openid-configuration
    status: 404
  - url: https://open-gateway.gsma.com/.well-known/oauth-authorization-server
    status: 404
  scopes: scopes/gsma-scopes.yml
- programme: GSMA Mobile Money API
  model: header-borne pre-shared credentials plus optional end-user OAuth 2.0/OIDC token
  declared_in_openapi: false
  headers:
  - name: X-API-Key
    purpose: Used to pass pre-shared client's API key to the server.
  - name: X-Client-Id
    purpose: Used to pass pre-shared client's identifier to the server.
  - name: X-User-Bearer
    purpose: Used to pass user's access token when OAuth 2.0/OIDC authorisation framework is used for end-user authentication.
  - name: X-User-Credential-1
    purpose: Per-user credential slot 1.
  - name: X-User-Credential-2
    purpose: Per-user credential slot 2.
  - name: X-Content-Hash
    purpose: SHA-256 hex digest of the request content (encrypted or plain), for basic data integrity checking.
  - name: X-Date
    purpose: Origination timestamp, used to reject stale requests.
  docs: https://developer.mobilemoneyapi.io/security/
  guidelines_pdf: https://developer.mobilemoneyapi.io/GSMA_Mobile_Money_API_Security_Design_and_Implementation_Guidelines-1_8.pdf