Lightspark Authentication

generated: '2026-07-19'
method: searched
source: openapi/lightspark-grid-openapi-original.yml
docs: https://docs.lightspark.com/api-reference/authentication
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
  oauth2_flows: []
  note: >-
    Grid has no OAuth2 authorization server and therefore no OAuth scope surface — scopes/ is
    intentionally absent. Platform calls use HTTP Basic with the API token id as username and the
    client secret as password; agent calls use a user-scoped bearer token. Tokens are scoped to
    exactly one environment (production or sandbox). API tokens are managed through the API itself
    via createToken / listTokens / getTokenById / deleteTokenById.
  additional_signals:
  - header: Grid-Wallet-Signature
    description: >-
      P-256 session-key signature over the exact `payloadToSign` returned by Grid. Required on
      embedded-wallet actions — add/revoke credential, revoke session, wallet export, wallet privacy
      update, and quote execution from an embedded wallet. Paired with the Request-Id header.
  - header: Request-Id
    description: Replayed from the challenge response on signed-retry flows; format `Request:<uuid>`.
  embedded_wallet_credential_types:
  - EMAIL_OTP
  - SMS_OTP
  - PASSKEY
  - OAUTH
schemes:
- name: BasicAuth
  type: http
  scheme: basic
  description: API token authentication using format `<api token id>:<api client secret>`
  sources:
  - openapi/lightspark-grid-openapi-original.yml
- name: AgentAuth
  type: http
  scheme: bearer
  description: 'Bearer token authentication for agent-scoped endpoints. The token is the `accessToken`
    returned when redeeming a device code via `POST /agents/device-codes/{code}/redeem`. Agent
    credentials are user-scoped: all requests are automatically bound to the agent''s associated
    customer and subject to the agent''s policy.'
  sources:
  - openapi/lightspark-grid-openapi-original.yml
- name: WebhookSignature
  type: apiKey
  in: header
  parameter: X-Grid-Signature
  description: |-
    Secp256r1 (P-256) asymmetric signature of the webhook payload, which can be used to verify that the webhook was sent by Grid.
    To verify the signature:
    1. Get the Grid public key provided to you during integration
    2. Decode the base64 signature from the header
    3. Create a SHA-256 hash of the request body
    4. Verify the signature using the public key and the hash

    If the signature verification succee
  sources:
  - openapi/lightspark-grid-openapi-original.yml