Pexa Authentication

generated: '2026-07-26'
method: searched
source:
- https://developer.pexa.com.au/Exchange/docs/documentation/ (Authentication, Authentication Compliance)
- https://developer.pexa.com.au/Projects/docs/documentation/
- https://developer.pexa.com.au/Webhooks/docs/definitions/webhooks/
- https://www.pexa.com.au/pexa-apis/
- https://auth.pexa.com.au/.well-known/openid-configuration
- openapi/pexa-notification-service-openapi.yaml
- openapi/pexa-projects-api-v4-openapi.yaml
- openapi/pexa-standalone-discharge-experience-api-openapi.yaml
docs: https://developer.pexa.com.au/Exchange/docs/documentation/
summary:
  types:
  - oauth2
  - mutualTLS
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  api_key_in: []
  statement: >-
    "We authenticate our APIs using industry best practices, either through OAuth2.0 or Mutual TLS."
    - https://www.pexa.com.au/pexa-apis/
  token_lifetime: 12 hours
  transport: PEXA only accepts TLS v1.2 protocol (or above)
  header: 'Authorization: Bearer <access_token>'
access_gate:
  self_serve: false
  requirement: signed PEXA API Agreement
  process:
  - Register at https://www.pexa.com.au/pexa-apis/ - PEXA validates the details
  - Once validated and approved, PEXA emails the test access details
  - Plan and design, build and test, production readiness, go live
  - Credential requests and re-issues via apisupport@pexa.com.au
  authorization_code_extra: PEXA also requires your redirect_uri before issuing authorization-code credentials
  portal_signup: disabled in the developer portal build (hideSignUp true; AWS Cognito identity)
authorization_servers:
- environment: production
  issuer: https://auth.pexa.com.au/
  authorization_endpoint: https://auth.pexa.com.au/authorize
  token_endpoint: https://auth.pexa.com.au/oauth/token
  revocation_endpoint: https://auth.pexa.com.au/oauth/revoke
  jwks_uri: https://auth.pexa.com.au/.well-known/jwks.json
  discovery: https://auth.pexa.com.au/.well-known/openid-configuration
  discovery_status: 200
  shape: Auth0
  token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post, private_key_jwt, none]
  code_challenge_methods_supported: [S256, plain]
  document: well-known/pexa-openid-configuration.json
- environment: test
  issuer: https://auth-tst.pexalabs.com.au/
  authorization_endpoint: https://auth-tst.pexalabs.com.au/authorize
  token_endpoint: https://auth-tst.pexalabs.com.au/oauth/token
  discovery: https://auth-tst.pexalabs.com.au/.well-known/openid-configuration
  discovery_status: 200
  document: well-known/pexa-openid-configuration-test.json
flows:
- flow: clientCredentials
  audience: machine-to-machine integrations
  parameters: [grant_type=client_credentials, client_id, client_secret, scope]
  note: >-
    Scope is required on the token request and is declared per endpoint in the developer portal.
    The documented example scope is au_pub_tst_pexa_conversation_api_v2_read.
- flow: authorizationCode
  audience: business-to-consumer - an individual user authenticating with their own PEXA credentials
  parameters: [client_id, response_type=code, redirect_uri, scope, 'then grant_type=authorization_code + code + client_secret']
  note: >-
    Prompts the user to log into PEXA with their individual login, password and multi-factor
    authentication at the start of every session.
- flow: mutualTLS
  audience: alternative to OAuth 2.0 for API authentication
  note: >-
    Offered as an alternative on the API integration page, with certificate error guidance in the
    Exchange documentation. Not declared as a securityScheme in any shipped contract.
- flow: private_key_jwt (outbound)
  audience: webhook delivery in HMAC_OAUTH mode
  note: >-
    In HMAC_OAUTH mode PEXA authenticates ITSELF to the customer's token endpoint, signing the client
    assertion with an AWS KMS RSA key using PS256. Claims: iss/sub = clientId, aud = authUrl,
    exp = now + 10 minutes, iat, jti (random UUID). client_secret is the alternative. Optional mTLS
    applies to both the token request and the delivery.
schemes:
- name: oauth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.pexa.com.au/oauth/token
    scopes: 5
  sources:
  - openapi/pexa-notification-service-openapi.yaml
- name: oauth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://host.kubernetes.internal/auth/realms/pexa/protocol/openid-connect/auth
    tokenUrl: https://host.kubernetes.internal/auth/realms/pexa/protocol/openid-connect/token
    scopes: 3
  - flow: clientCredentials
    tokenUrl: https://host.kubernetes.internal/auth/realms/pexa/protocol/openid-connect/token
    scopes: 3
  sources:
  - openapi/pexa-projects-api-v4-openapi.yaml
  spec_defect: >-
    The Projects v4 document ships an internal Keycloak URL (host.kubernetes.internal) as its
    authorization and token endpoint. The real endpoints are https://auth.pexa.com.au/oauth/token
    (production) and https://auth-tst.pexalabs.com.au/oauth/token (test).
- name: oauth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: "https://'{{auth2_env}}'/authorize"
    tokenUrl: "https://'{{auth2_env}}'/oauth/token"
  - flow: clientCredentials
    tokenUrl: "https://'{{auth2_env}}'/oauth/token"
  sources:
  - openapi/pexa-standalone-discharge-experience-api-openapi.yaml
  spec_defect: >-
    The Standalone Discharge document ships unresolved templates ({{auth2_env}}, {{api_scope}})
    rather than real endpoint URLs and scope names.
compliance_requirements:
- PEXA only accepts TLS v1.2 protocol
- The OAuth 2.0 flow implementation must be secure
- Client id and client secret must be securely stored and encrypted, and must not be accessible to
  software users or other parties
- The token request process must be executed securely and must not be interceptable
- The access token must be stored securely and encrypted
notes:
- No API-key authentication exists anywhere in the estate.
- No anonymous or public endpoint exists - even /health requires a token.
- >-
  The production OIDC discovery document advertises many Auth0 grant types (password, implicit,
  device_code, token-exchange, jwt-bearer). Only client_credentials and authorization_code are
  documented for PEXA API integrators; the rest are tenant defaults, not offered contracts.