Locbox Labs Authentication

generated: '2026-08-13'
method: searched
source: https://github.com/LocBoxLabs/hownd-examples
docs: https://github.com/LocBoxLabs/hownd-examples/blob/main/README.md
note: >-
  Hownd publishes no OpenAPI and no API reference, so this profile is not derived
  from a spec. It is transcribed from the company's own first-party example
  repository (LocBoxLabs is the Hownd GitHub organization, org email
  dev@hownd.com) and corroborated against the live OAuth/OIDC discovery document
  served by the company's Auth0 tenant, which was fetched anonymously.
summary:
  types: [oauth2]
  api_key_in: []
  oauth2_flows: [clientCredentials]
  bearer_token: true
  tenant_scoping: X-Tenant-Id header
schemes:
- name: HowndPartnerOAuth2
  type: oauth2
  api: Hownd Partner API
  flows:
  - flow: clientCredentials
    tokenUrl: https://hownd.auth0.com/oauth/token
    audience: https://partner-api.hownd.com
    scopes: {}
    scopes_note: >-
      No API scopes are published for the partner audience. The tenant's OIDC
      discovery document advertises only standard OpenID Connect scopes
      (openid, profile, email, offline_access, phone, address), which govern
      end-user login to the Auth0 tenant rather than partner API authorization.
  authorization_server:
    issuer: https://hownd.auth0.com/
    discovery: well-known/locbox-labs-openid-configuration.json
    jwks_uri: https://hownd.auth0.com/.well-known/jwks.json
    token_endpoint_auth_methods_supported:
    - client_secret_basic
    - client_secret_post
    - private_key_jwt
    - none
    grant_types_supported_includes_client_credentials: true
    id_token_signing_alg_values_supported: [HS256, RS256, PS256]
    dpop_signing_alg_values_supported: [ES256]
  sources:
  - https://github.com/LocBoxLabs/hownd-examples/blob/main/main.go
  - https://hownd.auth0.com/.well-known/openid-configuration
required_headers:
- name: Authorization
  value: Bearer [token]
  required: true
  source: https://github.com/LocBoxLabs/hownd-examples
- name: Content-Type
  value: application/json
  required: true
  source: https://github.com/LocBoxLabs/hownd-examples
- name: X-Tenant-Id
  value: value provided by Hownd
  required: true
  description: >-
    Identifies which Hownd customer (merchant/business) the partner is acting on
    behalf of. Hownd's own note - "Arguably the Tenant ID could be used in the
    HTTP path. Since it is security related, a header felt more appropriate."
  source: https://github.com/LocBoxLabs/hownd-examples
credential_issuance:
  self_service: false
  process: >-
    Client credentials and a per-merchant Tenant ID are issued by Hownd to
    approved partners. There is no public sign-up, developer portal, or key
    self-service page.
  restrictions: >-
    Hownd states the credentials "must be secured and cannot be used in any
    integration scenario other than server to server" and "must not be used in a
    browser or mobile application."
x-evidence:
- {url: 'https://github.com/LocBoxLabs/hownd-examples', http_status: 200, fetched: '2026-08-13'}
- {url: 'https://hownd.auth0.com/.well-known/openid-configuration', http_status: 200, fetched: '2026-08-13'}
- {url: 'https://hownd.auth0.com/.well-known/jwks.json', http_status: 200, fetched: '2026-08-13'}
- {url: 'https://partner-api.hownd.com/', http_status: 404, fetched: '2026-08-13', note: 'host is live and answering (Go http server default 404); no route documented publicly'}