Kpn Authentication

generated: '2026-07-25'
method: searched
source: openapi/apidaze-voice-openapi.yml, openapi/kpn-disturbance-check-openapi.yml, openapi/kpn-fiam-eneco-data-products-openapi.yml,
  openapi/kpn-fiam-openapi.yml, openapi/kpn-high-level-design-ftth-openapi.yml, openapi/kpn-internet-speed-check-openapi.yml,
  openapi/kpn-ise-openapi.yml, openapi/kpn-lora-device-management-openapi.yml, openapi/kpn-match-openapi.yml, openapi/kpn-mobile-services-management-openapi.yml,
  openapi/kpn-number-verify-openapi.yml, openapi/kpn-sd-lan-sd-wan-network-view-openapi.yml ...
docs:
- https://developer.kpn.com/page/getting-started
- https://developer.kpn.com/documentation/kpn-sms-api-documentation
- https://developer.kpn.com/documentation-response-headers
standard: KPN Store API Authentication Standard - OAuth 2.0 client credentials
credentials: Client ID + Client Secret issued per project in the KPN Developer portal dashboard (https://developer.kpn.com/dashboard/register);
  the same credentials work in test mode and, after upgrade via KRN or iDIN, in production.
token_endpoints:
- url: https://api-prd.kpn.com/oauth/client_credential/accesstoken?grant_type=client_credentials
  scope: default gateway token endpoint used by the whole KPN API Store
- url: https://api-prd.kpn.com/oauth/grip/msm/accesstoken?grant_type=client_credentials
  scope: Mobile Services Management API
- url: https://api-prd.kpn.com/fiam/api/v1/oauth/token
  scope: FIAM (operationId access_token) - federated identity and access management
- url: https://auth.grip-on-it.com/v2/{tenant.id}/oidc/idp/token
  scope: KPN GRIP identity and access management (tenant-scoped; client_id + client_secret + audience id)
request_header: 'Authorization: Bearer <access_token>'
scopes:
  declared: 0
  note: No OAuth scopes are declared anywhere in the 34 published definitions; authorisation is entitlement-based
    (which products are added to your project). See scopes/kpn-scopes.yml.
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://api-prd.kpn.com/oauth/client_credential/accesstoken?grant_type=client_credentials
    scopes: 0
  sources:
  - openapi/apidaze-voice-openapi.yml
  - openapi/kpn-disturbance-check-openapi.yml
  - openapi/kpn-high-level-design-ftth-openapi.yml
  - openapi/kpn-internet-speed-check-openapi.yml
  - openapi/kpn-ise-openapi.yml
  - openapi/kpn-lora-device-management-openapi.yml
  - openapi/kpn-mobile-services-management-openapi.yml
  - openapi/kpn-sd-lan-sd-wan-network-view-openapi.yml
  - openapi/kpn-servicenow-connect-openapi.yml
  - openapi/kpn-sim-swap-openapi.yml
  - openapi/kpn-sms-openapi.yml
  - openapi/kpn-tv-guide-openapi.yml
  - openapi/kpn-webhook-privacy-config-manager-openapi.yml
  - openapi/kpn-webhook-signing-keys-openapi.yml
  - openapi/kpn-wholesale-broadband-access-fpi-cip-openapi.yml
  - openapi/parley-secure-messenger-openapi.yml
  - openapi/pollyhelp-knowledge-management-openapi.yml
  - openapi/registered-email-openapi.yml
  - openapi/tracebuzz-social-media-webcare-openapi.yml
  - openapi/vonage-messages-openapi.yml
  - openapi/vonage-number-insight-openapi.yml
  - openapi/vonage-phone-numbers-openapi.yml
  - openapi/vonage-sms-openapi.yml
  - openapi/vonage-verify-openapi.yml
  - openapi/vonage-voice-openapi.yml
  - openapi/weseedo-direct-openapi.yml
  - openapi/weseedo-personal-openapi.yml
  - openapi/xdroid-speech-to-text-openapi.yml
- name: apikey
  type: apiKey
  in: header
  parameter: apikey
  description: Apigee API key
  sources:
  - openapi/kpn-fiam-eneco-data-products-openapi.yml
- name: bearer_auth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: JWT Bearer token obtained from /oauth/token endpoint
  sources:
  - openapi/kpn-fiam-openapi.yml
  - openapi/kpn-match-openapi.yml
  - openapi/kpn-number-verify-openapi.yml
  - openapi/vonage-messages-openapi.yml
notes:
- Number Verify and Match additionally expose their own POST /token operation layered on top of the gateway token.
- 'The FIAM Eneco Data Products API is the one estate exception: it authenticates with an Apigee apikey request
  header instead of OAuth.'
- Tokens expire; the webhook configuration APIs explicitly instruct clients to refresh before expiry. KPN does not
  publish the token lifetime.
- 'KPN GRIP is the one product with a full identity stack of its own: it issues tokens from its own tenant-scoped
  authorization server at auth.grip-on-it.com and speaks SAML 2.0, OpenID Connect and OAuth 2 to relying parties.
  Anonymous /.well-known/openid-configuration is not served - discovery is tenant-scoped.'