Honey Insurance Authentication

generated: '2026-07-25'
method: searched
source: https://auth.honeyinsurance.com/.well-known/openid-configuration
docs: null
developer_credentials: false
note: >-
  Honey Insurance issues no developer API credentials. There is no developer
  portal, no key-issuance page and no client-registration path documented for
  third parties. The one authentication surface that is anonymously
  discoverable is an Auth0 custom-domain tenant used for consumer "My account"
  sign-in; its metadata is captured verbatim in
  well-known/honey-insurance-openid-configuration.json. The private backend at
  api.honeyinsurance.com publishes no auth documentation and denies all
  anonymous requests with HTTP 403.
summary:
  types:
  - openIdConnect
  - oauth2
  audience: end-user consumer accounts only
  oauth2_flows:
  - authorizationCode
  - implicit
  - clientCredentials
  - deviceCode
  - refreshToken
  - password
  api_key_in: []
  mutual_tls: false
schemes:
- name: Auth0OIDC
  type: openIdConnect
  openIdConnectUrl: https://auth.honeyinsurance.com/.well-known/openid-configuration
  issuer: https://auth.honeyinsurance.com/
  source: well-known/honey-insurance-openid-configuration.json
  endpoints:
    authorization: https://auth.honeyinsurance.com/authorize
    token: https://auth.honeyinsurance.com/oauth/token
    userinfo: https://auth.honeyinsurance.com/userinfo
    jwks: https://auth.honeyinsurance.com/.well-known/jwks.json
    revocation: https://auth.honeyinsurance.com/oauth/revoke
    registration: https://auth.honeyinsurance.com/oidc/register
    device_authorization: https://auth.honeyinsurance.com/oauth/device/code
    mfa_challenge: https://auth.honeyinsurance.com/mfa/challenge
    backchannel_authentication: https://auth.honeyinsurance.com/bc-authorize
    global_token_revocation: https://auth.honeyinsurance.com/oauth/global-token-revocation/connection/{connectionName}
  grant_types_supported:
  - client_credentials
  - authorization_code
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  response_types_supported:
  - code
  - token
  - id_token
  - code token
  - code id_token
  - token id_token
  - code token id_token
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  code_challenge_methods_supported:
  - S256
  - plain
  id_token_signing_alg_values_supported:
  - HS256
  - RS256
  - PS256
  subject_types_supported:
  - public
  dpop_signing_alg_values_supported:
  - ES256
  backchannel_token_delivery_modes_supported:
  - poll
  backchannel_logout_supported: true
  backchannel_logout_session_supported: true
  request_parameter_supported: false
  request_uri_parameter_supported: false
  mfa: true
tokens:
  format: JWT
  signing: RS256 / PS256 / HS256 (per Auth0 tenant metadata)
  pkce: supported (S256)
  jwks: well-known/honey-insurance-jwks.json
gaps:
- No API audience is published, so no access token can be requested for an
  insurance-domain API.
- No developer client registration; /oidc/register is the stock Auth0 dynamic
  registration endpoint and is not documented for third parties.
- No insurance-domain scopes exist — see scopes/honey-insurance-scopes.yml.
- The production API host (api.honeyinsurance.com) documents no scheme at all.
related:
  scopes: scopes/honey-insurance-scopes.yml
  well_known: well-known/honey-insurance-well-known.yml
  conformance: conformance/honey-insurance-conformance.yml