Keyfactor · Authentication Profile

Keyfactor Authentication

Authentication

Keyfactor secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and password flow(s).

CompanyCybersecurityPKIMachine IdentityCertificate LifecycleCode SigningCryptographyDigital TrustSecurity
Methods: http, oauth2 Schemes: 2 OAuth flows: clientCredentials, password API key in:

Security Schemes

activeDirectoryBasic http
scheme: basic
oauth2ClientCredentials oauth2

Source

Authentication Profile

keyfactor-authentication.yml Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/AuthenticateAPI.htm
docs: https://software.keyfactor.com/Core-OnPrem/Current/Content/WebAPI/AuthenticateAPI.htm
summary:
  types: [http, oauth2]
  api_key_in: []
  oauth2_flows: [clientCredentials, password]
  scope: >-
    Keyfactor Command Web API. EJBCA REST API additionally supports client
    (mutual-TLS) certificate authentication per deployment.
schemes:
  - name: activeDirectoryBasic
    type: http
    scheme: basic
    description: >-
      Active Directory service-account authentication (HTTP Basic or Windows
      integrated authentication) against a Keyfactor Command instance.
  - name: oauth2ClientCredentials
    type: oauth2
    flow: clientCredentials
    description: >-
      OAuth 2.0 client-credentials grant via an OIDC identity provider
      (Keycloak or equivalent). Access token is sent as `Authorization: Bearer
      <token>`. Password grant is also supported for development scenarios.
required_headers:
  - name: x-keyfactor-requested-with
    value: APIClient
  - name: Authorization
    value: Basic <creds> | Bearer <token>
  - name: Accept
    value: application/json
notes: >-
  Keyfactor Command is self-hosted or Cloud PKI-as-a-Service; the specific
  identity provider and token endpoints are configured per customer instance.