Noyo · Authentication Profile

Noyo Authentication

Authentication

Noyo secures its APIs with oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyHealthcareInsuranceEmployee BenefitsEnrollmentBenefits AdministrationInsurance CarriersData ExchangeWebhooksHealth Insurance
Methods: oauth2 Schemes: 2 OAuth flows: clientCredentials API key in:

Security Schemes

clientCredentials oauth2
bearerAuth http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-20'
method: searched
source: https://docs.noyo.com/docs/introduction/getting-started/authentication
docs: https://docs.noyo.com/docs/introduction/getting-started/authentication
summary:
  types: [oauth2]
  oauth2_flows: [clientCredentials]
  token_delivery: bearer
  notes: >-
    Noyo issues API keys (CLIENT_ID / CLIENT_SECRET) managed by an organization
    admin in the Noyo web application. Keys are exchanged for a short-lived
    bearer access token via an OAuth2 client-credentials style token endpoint;
    the CLIENT_ID:CLIENT_SECRET pair is sent as HTTP Basic auth on the token
    request. The returned access_token is then sent as a Bearer token on each
    API call. Sandbox and production use separate keys. The OpenAPI documents
    do not declare securitySchemes, so this profile is sourced from the docs.
schemes:
- name: clientCredentials
  type: oauth2
  flow: clientCredentials
  token_url: https://accounts.noyo.com/auth/public/token
  grant_type: client_credentials
  client_auth: basic
  token_type: Bearer
  token_ttl_seconds: 600
  sources: [docs]
- name: bearerAuth
  type: http
  scheme: bearer
  description: 'Short-lived access token returned by the token endpoint, sent as: Authorization Bearer <ACCESS_TOKEN>.'
  sources: [docs]
environments:
  production: https://fulfillment.noyo.com
  sandbox: https://fulfillment-sandbox.noyo.com