Spark Platform Authentication

generated: '2026-07-26'
method: searched
source: >-
  https://sparkplatform.com/docs/authentication/access_token,
  https://sparkplatform.com/docs/authentication/openid_connect_authentication,
  https://sparkplatform.com/docs/authentication/saml,
  https://sparkplatform.com/.well-known/openid-configuration (HTTP 200, harvested verbatim to
  authentication/spark-platform-openid-configuration.json).
docs: https://sparkplatform.com/docs/authentication/authentication
description: >-
  Spark Platform's authentication profile. There is no OpenAPI to derive securitySchemes from,
  so this profile is read from the published authentication documentation plus the one
  machine-readable identity document Spark serves anonymously — its OpenID Connect discovery
  document. Four mechanisms are documented: an OAuth 2 / MLS-issued Bearer access token (the
  normal path for data access), OpenID Connect (member identity, MLS approval required), SAML
  (service-provider integration with flexmls Web), and a legacy signed-request API key. Every
  data endpoint returns HTTP 401 with Spark code 1000 when called anonymously.
summary:
  types: [http-bearer, oauth2, openIdConnect, saml, apiKey-signed]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]

schemes:
  - name: Bearer access token
    type: http
    scheme: bearer
    in: header
    parameter: Authorization
    format: "Authorization: Bearer <your_access_token>"
    issued_by: >-
      OAuth 2 authorization, or a non-expiring access token issued by the MLS alongside an
      OAuth key (API feed ID). The same token authorizes both the Spark API and the RESO Web
      API endpoints.
    required_with: Accept header; HTTPS required (code 1030 otherwise)
    docs: https://sparkplatform.com/docs/authentication/access_token
    applies_to: [Spark API, Spark RESO Web API]

  - name: OpenID Connect
    type: openIdConnect
    openIdConnectUrl: https://sparkplatform.com/.well-known/openid-configuration
    issuer: https://sparkplatform.com
    authorizationUrl: https://sparkplatform.com/openid/authorize
    tokenUrl: https://sparkplatform.com/openid/token
    userinfoUrl: https://sparkplatform.com/openid/userinfo
    revocationUrl: https://sparkplatform.com/openid/revoke
    jwks_uri: https://sparkplatform.com/openid/jwks.json
    id_token_signing_alg: [RS256]
    token_endpoint_auth_methods: [client_secret_post, client_secret_basic]
    response_types: [code, id_token, "id_token token", "code token", "id_token code", "id_token code token"]
    subject_types: [public, pairwise]
    claims_parameter_supported: true
    scopes: [openid, profile, email, address, phone, RESO, FBS]
    scope_detail: scopes/spark-platform-scopes.yml
    gate: Requires separate MLS approval before OIDC keys are issued.
    docs: https://sparkplatform.com/docs/authentication/openid_connect_authentication
    note: >-
      The claim set is real-estate specific and encodes the licensing substrate itself —
      MemberMlsId, MemberNrdsId, MemberStateLicense, MemberAOR/MemberAORkey,
      MemberPrimaryAorId, MemberType, MemberStatus, OfficeKey/OfficeMlsId, FlexmlsMemberType
      and mls_system_access. This is the only machine-readable contract Spark serves without
      credentials.
    harvested: authentication/spark-platform-openid-configuration.json

  - name: SAML
    type: saml
    docs: https://sparkplatform.com/docs/authentication/saml
    note: SAML service-provider integration with flexmls Web for member single sign-on.

  - name: Legacy API key with request signing
    type: apiKey
    in: header
    documented: partial
    note: >-
      Evidenced by the 401 body returned by both sparkapi.com/v1 and the OData endpoints —
      "Invalid API key and/or request signed improperly" (code 1000) — and by the
      Supplemental Authentication Services page in the docs navigation. Superseded by the
      Bearer token flow for new integrations.

session_semantics:
  session_token_expiry: Code 1020 "Session token has expired" on expired session tokens.
  key_restrictions:
    - Keys can be restricted to specific IP addresses and/or User-Agent values (code 1019).
    - Keys can be read-only; POST/PUT/DELETE then return code 1017.
    - Keys can be restricted to replication.sparkapi.com (code 1021).
    - Auth mechanism itself can be restricted per key (code 1013).

authorization_model:
  mechanism: role-scoped keys
  roles: [IDX, VOW, Private, Broker/Agent own data, Public, Portal]
  note: >-
    Authorization is not scope-based on the data API. What a valid token can see is determined
    by the role assigned to its key and by which MLS data plans the developer has been approved
    for. OAuth scopes exist only on the OpenID Connect identity surface.
  docs: https://sparkplatform.com/docs/supporting_documentation/roles

access_gate:
  classification: licence-agreement
  note: >-
    Credentials are not self-serve. Free public developer registration yields demo credentials
    only; production MLS data requires a signed FBS Developer Agreement, a role assignment and
    an MLS-approved data plan purchased through the Spark Datamart at USD 50/month per MLS.
  docs: https://sparkplatform.com/docs/overview/set_up_access