Myome Authentication

generated: '2026-08-26'
method: searched
source: 'openapi/myome-openapi.json (components.securitySchemes) enriched from the "API Conventions >
  Authorization" section of the published API reference at https://api.myome.com/0/ui/ (HTTP 200),
  plus live probes of api.myome.com and auth.myome.com on 2026-08-26.'
docs: https://api.myome.com/0/ui/
summary:
  types:
  - http
  self_service: false
  self_service_detail: 'There is no sign-up or key-issuance flow. MyOme provides partner-specific
    credentials by secure email during account creation, so API access requires a partner relationship
    established out of band.'
schemes:
- name: jwt
  type: http
  scheme: bearer
  bearerFormat: JWT
  header: 'Authorization: Bearer <token>'
  description: 'JSON Web Token (JWT) obtained from Keycloak with partner-specific credentials.'
  issuer:
    host: auth.myome.com
    product: Keycloak
    evidence: 'The spec states "Client obtains JWT from auth.myome.com" and "a JWT generated using
      Keycloak with partner-specific credentials". Confirmed by probe: auth.myome.com answers with
      Keycloak/RESTEasy error bodies ("RESTEASY003210: Could not find resource for full path"), and
      https://auth.myome.com/health returns 200.'
    oidc_discovery: null
    oidc_discovery_note: 'No OIDC discovery document is reachable anonymously.
      /.well-known/openid-configuration 404s at the host root, and /realms/<realm>/.well-known/
      openid-configuration and /auth/realms/<realm>/.well-known/openid-configuration were probed for
      ten candidate realm names (myome, partner, partners, api, master, external, clients, myome-api,
      production, prod) — every one 404. The realm name is partner-private.'
  token_lifetime: 'The token refreshes every hour.'
  credential_delivery: 'MyOme will provide credentials to partners via secure email during account
    creation. Those credentials should be kept confidential.'
  applied_to: 'security: [{jwt: []}] is applied per-operation on 7 of the 8 publicly visible
    operations. GET /consent declares security: [] (empty), but the live gateway still refuses
    unauthenticated calls, so no operation is anonymously callable in practice.'
  sources:
  - openapi/myome-openapi.json
  - https://api.myome.com/0/ui/
oauth2:
  present: false
  scopes: []
  note: 'No oauth2 securityScheme, no flows, no authorizationUrl/tokenUrl and no scope vocabulary are
    declared. The grant used to mint the JWT at Keycloak is not described in the public contract, so
    no scopes/ artifact is emitted — deriving one would be invention.'
api_keys:
  present: false
mutual_tls:
  present: false
observed:
- url: https://api.myome.com/0/product
  status: 401
  body: '{"type": "about:blank", "title": "Unauthorized", "detail": "No authorization token provided", "status": 401}'
notes: 'Single-scheme, bearer-JWT auth with no scope model and no self-service issuance. For an agent
  this means access is all-or-nothing: a partner token carries whatever the partner account can do,
  and there is no published way to mint a narrower credential for a read-only or single-purpose agent.'