Kore Wireless Authentication

generated: '2026-07-25'
method: searched
source: openapi/kore-wireless-api-clients.yml, openapi/kore-wireless-connectivity-pro.yml,
  openapi/kore-wireless-iam.yml, openapi/kore-wireless-programmable-wireless.yml,
  openapi/kore-wireless-sms.yml, openapi/kore-wireless-supersim.yml, openapi/kore-wireless-webhook.yml
docs: https://docs.korewireless.com/developers/api-management/auth
client_docs: https://docs.korewireless.com/developers/api-management/api-clients
refresh_guide: https://docs.korewireless.com/developers/how-to/apis/refresh-api-access-token
summary:
  primary: oauth2 client_credentials
  types: [oauth2, apiKey, http]
  api_key_in: [header]
  oauth2_flows: [clientCredentials]
  bearer_header: 'Authorization: Bearer {access_token}'
  credential_unit: API Client (Client ID + Client Secret), created per account in the
    console
primary_flow:
  name: OAuth 2.0 Client Credentials (RFC 6749 section 4.4)
  token_endpoint: https://api.korewireless.com/api-services/v1/auth/token
  method: POST
  content_type: application/x-www-form-urlencoded
  parameters: [grant_type=client_credentials, client_id, client_secret]
  example_request: |
    curl -X POST https://api.korewireless.com/api-services/v1/auth/token \
      --header 'cache-control: no-cache' \
      --header 'content-type: application/x-www-form-urlencoded' \
      --data "grant_type=client_credentials" \
      --data "client_id=$KORE_CLIENT_ID" \
      --data "client_secret=$KORE_CLIENT_SECRET"
  response_shape: '{access_token, expires_in, token_type: Bearer, scope}'
  token_format: RS256-signed JWT (iss/aud/sub/exp/iat/jti plus KORE claims account-id,
    client-type, client_id, scopes)
  expires_in_unit: seconds
  expiry_options: [1 hour, 24 hours, 30 days, 24 months]
  refresh: no refresh token — repeat the client-credentials exchange
  spec: openapi/kore-wireless-token.yml
credentials:
  where: API Client details in the KORE console (https://build.korewireless.com/clients/list)
  client_secret_visibility: shown once at creation and never retrievable again
  client_id_visibility: always visible
  scoping: Client Type (Admin or Standard) plus selected Global Resources and Products
  locking: a client can be locked so only Account Owner, Account Admins and the Client
    Owner may edit it
  per_account: a client targets exactly one account; child accounts each need their
    own client
errors:
- {stage: token exchange, http: 401, body: '{"error":"unauthorized_client","error_description":"Invalid
    client or Invalid client credentials"}'}
- {stage: API call, http: 403, body: '{"message":"User is not authorized to access
    this resource with an explicit deny","error":"Invalid or expired token"}'}
schemes:
- name: Auth
  type: oauth2
  flows:
  - {flow: clientCredentials, tokenUrl: 'https://api.korewireless.com/api-services/v1/auth/token',
    scopes: 0}
  sources:
  - openapi/kore-wireless-api-clients.yml
  - openapi/kore-wireless-connectivity-pro.yml
  - openapi/kore-wireless-iam.yml
  - openapi/kore-wireless-programmable-wireless.yml
  - openapi/kore-wireless-sms.yml
  - openapi/kore-wireless-supersim.yml
  - openapi/kore-wireless-webhook.yml
  status: current
- name: api_key
  type: apiKey
  in: header
  parameter: x-api-key
  sources: [openapi/kore-wireless-connectivity-pro.yml, openapi/kore-wireless-sms.yml]
  status: declared in spec, not documented
  note: >-
    Both specs declare an x-api-key header scheme alongside the OAuth scheme. The
    developer documentation describes only the OAuth 2.0 path, so treat the API key
    as a legacy developer-portal artifact rather than a supported alternative.
- name: accountSid_authToken
  type: http
  scheme: basic
  sources: [openapi/kore-wireless-supersim.yml]
  status: legacy (Twilio IoT inheritance)
  note: >-
    The Super SIM spec retains the Twilio-era Account SID + Auth Token HTTP Basic
    scheme next to the KORE OAuth scheme. Migration guidance moves callers to
    KORE client credentials.
webhook_direction:
  description: authenticity of KORE-to-customer callbacks is a separate contract —
    KORE signs every event with the kore-signature header.
  docs: https://docs.korewireless.com/developers/how-to/webhooks/validate-webhook-signatures
  artifact: asyncapi/kore-wireless-event-streams-webhooks.yml
cross_links:
  scopes: scopes/kore-wireless-scopes.yml
  conventions: conventions/kore-wireless-conventions.yml
  errors: errors/kore-wireless-error-codes.yml