Sprinklr Authentication

generated: '2026-08-12'
method: searched
source: https://dev.sprinklr.com/authorize
docs:
  - https://dev.sprinklr.com/authorize
  - https://dev.sprinklr.com/api-key-and-secret-generation
  - https://dev.sprinklr.com/getting-started
  - https://dev.sprinklr.com/refreshing-access-token
  - https://dev.sprinklr.com/authorization-troubleshooting
note: >-
  Derived-from-spec is not possible: Sprinklr publishes no OpenAPI, so this
  profile is read directly from the developer-portal authorization pages.
  Sprinklr's model is unusual in that BOTH an OAuth 2.0 bearer token AND a
  static API key are required on every call — the key travels in a bare `key`
  header, not Authorization.
summary:
  types: [oauth2, apiKey, mutualTLS]
  api_key_in: [header]
  api_key_name: key
  oauth2_flows: [authorizationCode, clientCredentials, jwt-bearer]
  both_required: true
  scopes_published: false
schemes:
  - name: apiKey
    type: apiKey
    in: header
    parameter_name: key
    description: >-
      The API key (client_id) issued per environment. Acts as both a unique
      identifier and a secret token. Sent on every request alongside the bearer
      token; omitting it yields 403 "Developer Inactive".
    expiry: none
    rotation: >-
      Keys and secrets do not expire. They are static and can only be deleted or
      disabled from the customer's Sprinklr developer account.
    issuance:
      current: >-
        All Settings > APIs and Integrations > Developer Tools inside the
        Sprinklr platform (26.1 release onward).
      legacy: dev.sprinklr.com developer portal > Apps > + New App
      docs: https://www.sprinklr.com/help/articles/developer-tools/developer-tools-in-sprinklr/692e8b39f0afa271
      note: >-
        The secret is masked and is revealed only after confirming from an email
        sent to the registered developer-portal address.
  - name: bearerAuth
    type: http
    scheme: bearer
    in: header
    parameter_name: Authorization
    format: 'Bearer {access_token}'
    description: OAuth 2.0 access token, obtained through one of the flows below.
  - name: oauth2
    type: oauth2
    flows:
      - flow: authorizationCode
        label: OAuth 2.0 for Customers (Code Grant)
        authorizationUrl: 'https://api3.sprinklr.com/{env}/oauth/authorize'
        tokenUrl: 'https://api3.sprinklr.com/{env}/oauth/token'
        refreshUrl: 'https://api3.sprinklr.com/{env}/oauth/token'
        scopes: {}
        scopes_note: >-
          Sprinklr's authorize URL takes client_id, response_type and
          redirect_uri only. No `scope` parameter is documented and no scope
          registry is published, so scopes/ is deliberately absent from this
          repo rather than fabricated. Authorization is governed instead by the
          Sprinklr platform role/permission model and by the partner+client
          workspace combination the user selects at consent time.
        request_content_type: application/x-www-form-urlencoded
        code_ttl_seconds: 600
        code_ttl_note: The authorization code is valid for 10 minutes.
      - flow: clientCredentials
        label: Client Credentials Grant Type (Default User)
        tokenUrl: 'https://api3.sprinklr.com/{env}/oauth/token'
        description: >-
          Generates a token without an authorization code. Requires a default
          user to be configured on the Sprinklr side; the token then acts as
          that user.
      - flow: jwt-bearer
        label: JWT Certificate Based Token Generation
        description: Certificate-based JWT token generation, documented alongside the OAuth flows.
      - flow: authorizationCode
        label: OAuth 2.0 SSO for Partners
        description: Partner-side SSO variant of the code grant.
  - name: mutualTLS
    type: mutualTLS
    description: >-
      Mutual TLS Authentication is listed as a supported authorization method in
      the developer portal's Authorize section. No certificate-issuance
      procedure is published publicly.
  - name: communityToken
    type: apiKey
    in: header
    description: >-
      The Community APIs use a separate authorization process entirely,
      requiring a projectId and preSharedKey to mint unauthenticated and
      authenticated tokens. Sprinklr routes access through a success manager;
      the endpoints are Create Unauthenticated Token and Create Authenticated
      Token.
    docs: https://dev.sprinklr.com/community-apis
token:
  type: Bearer
  access_token_ttl_seconds: 2591999
  access_token_ttl_human: 30 days
  refresh:
    supported: true
    grant_type: refresh_token
    single_use: true
    note: >-
      The refresh token has no expiry but can be used only once — regenerating
      produces a new refresh token and invalidates the previous one. Refresh
      token must be URL-encoded.
  constraints:
    - >-
      ONE TOKEN PER API KEY. If two stateless instances share a client_id, the
      second token generation invalidates the first instance's access AND
      refresh token. Each instance needs its own key/token pair.
    - >-
      Tokens are environment-specific. A key/token minted for one Sprinklr
      environment returns HTTP 421 Misdirected Request against another.
    - Tokens remain valid only while the authenticating user's Sprinklr password is valid.
    - The user must hold the "Generate Token" permission inside the Sprinklr platform.
environments:
  pattern: 'https://api3.sprinklr.com/{env}/api/{version}/{endpoint}'
  note: >-
    {env} is the Sprinklr hosting environment (prod0, prod2, prod3, prod4,
    prod8, ...). For the default Production environment (app.sprinklr.com) the
    {env} segment is omitted entirely:
    https://api3.sprinklr.com/api/v1/{endpoint}. Customers find their
    environment by searching the Sprinklr UI page source for
    "sentry-environment".
required_headers:
  - {name: Authorization, value: 'Bearer {access_token}'}
  - {name: key, value: '{api_key}'}
  - {name: Content-Type, value: application/json}
gaps:
  - No OAuth scopes published; no /.well-known/oauth-authorization-server and no /.well-known/openid-configuration on any Sprinklr host (all 404 — see well-known/).
  - No public self-service signup that yields a working token; the OAuth flow requires an existing licensed Sprinklr platform account.
  - Access-token TTL is documented inconsistently (2591999s / 30 days on the getting-started page; 28799s / 8 hours in the refresh-token example response).