Planet Authentication

generated: '2026-07-20'
method: searched
source: https://docs.planet.com/develop/authentication/
docs: https://docs.planet.com/develop/authentication/
summary:
  types: [apiKey, oauth2, openIdConnect]
  api_key_in: [header, query, basic-auth-username]
  oauth2_flows: [authorizationCode, clientCredentials, deviceCode]
schemes:
- name: PlanetAPIKey
  type: apiKey
  description: >-
    Planet API key. Presented three ways - (1) HTTP Basic auth with the API key as
    the username and an empty password (preferred where supported); (2) an
    Authorization header of the form `Authorization: api-key <api_key>`; (3) an
    `api_key` URL query parameter. Keys are found on the Account page under My
    Settings.
  in: [header, query]
  locations:
    basic_auth: username=<api_key>, password empty
    header: 'Authorization: api-key <api_key>'
    query: api_key=<api_key>
- name: PlanetOAuth2
  type: oauth2
  description: >-
    OAuth2 / OIDC via login.planet.com (Auth0-backed). Authorization Code grant
    for interactive user sessions (supports MFA and federated login); Client
    Credentials grant for machine-to-machine (rolling out for api.planet.com,
    available today for Sentinel Hub services). Access tokens are JWTs presented as
    `Authorization: Bearer <access_token>`.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.planet.com/authorize
    tokenUrl: https://login.planet.com/oauth/token
  - flow: clientCredentials
    tokenUrl: https://login.planet.com/oauth/token
    note: >-
      Machine-to-machine; for Sentinel Hub services the token endpoint is
      https://services.sentinel-hub.com/auth/realms/main/protocol/openid-connect/token
  - flow: deviceCode
    deviceAuthorizationUrl: https://login.planet.com/oauth/device/code
    tokenUrl: https://login.planet.com/oauth/token
- name: PlanetOIDC
  type: openIdConnect
  openIdConnectUrl: https://login.planet.com/.well-known/openid-configuration
  description: >-
    OpenID Connect discovery is published at login.planet.com. Issuer
    https://login.planet.com/, JWKS at /.well-known/jwks.json.