Noyo Authentication

generated: '2026-07-20'
method: searched
source: https://docs.noyo.com/docs/introduction/getting-started/authentication
docs: https://docs.noyo.com/docs/introduction/getting-started/authentication
summary:
  types: [oauth2]
  oauth2_flows: [clientCredentials]
  token_delivery: bearer
  notes: >-
    Noyo issues API keys (CLIENT_ID / CLIENT_SECRET) managed by an organization
    admin in the Noyo web application. Keys are exchanged for a short-lived
    bearer access token via an OAuth2 client-credentials style token endpoint;
    the CLIENT_ID:CLIENT_SECRET pair is sent as HTTP Basic auth on the token
    request. The returned access_token is then sent as a Bearer token on each
    API call. Sandbox and production use separate keys. The OpenAPI documents
    do not declare securitySchemes, so this profile is sourced from the docs.
schemes:
- name: clientCredentials
  type: oauth2
  flow: clientCredentials
  token_url: https://accounts.noyo.com/auth/public/token
  grant_type: client_credentials
  client_auth: basic
  token_type: Bearer
  token_ttl_seconds: 600
  sources: [docs]
- name: bearerAuth
  type: http
  scheme: bearer
  description: 'Short-lived access token returned by the token endpoint, sent as: Authorization Bearer <ACCESS_TOKEN>.'
  sources: [docs]
environments:
  production: https://fulfillment.noyo.com
  sandbox: https://fulfillment-sandbox.noyo.com