Target Authentication

generated: '2026-08-27'
method: searched
source: https://oauth.iam.target.com/.well-known/openid-configuration
docs: https://logonservices.oauth.iam.partnersonline.com/guide/
description: >-
  Target runs two separate OpenID Connect issuers, both of which publish an anonymous discovery
  document. oauth.iam.target.com fronts the corporate identity domain used by developer.target.com
  (the internal/partner API developer portal). oauth.iam.partnersonline.com fronts Target Partners
  Online, the supplier and vendor portal. The two documents are identical in shape and differ only
  in issuer and endpoint host. Neither issuer serves an RFC 8414 oauth-authorization-server document;
  discovery is OIDC-only. Target publishes no anonymous API key or bearer-token program — every
  credential is issued through a Target relationship (employee, vendor, Target Plus partner).
summary:
  types:
  - oauth2
  - openIdConnect
  issuers: 2
  anonymous_registration: false
schemes:
- name: targetIamOidc
  type: openIdConnect
  method: searched
  openIdConnectUrl: https://oauth.iam.target.com/.well-known/openid-configuration
  issuer: https://oauth.iam.target.com
  authorization_endpoint: https://oauth.iam.target.com/auth/oauth/v2/authorize
  token_endpoint: https://oauth.iam.target.com/auth/oauth/v2/token
  userinfo_endpoint: https://oauth.iam.target.com/openid/connect/v1/target/userinfo
  jwks_uri: https://oauth.iam.target.com/openid/connect/jwks.json
  registration_endpoint: https://oauth.iam.target.com/openid/connect/register
  grant_types_supported:
  - authorization_code
  - implicit
  response_types_supported:
  - code
  - token id_token
  scopes_supported:
  - openid
  - email
  - profile
  - openid_client_registration
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  id_token_signing_alg_values_supported:
  - RS256
  - HS256
  subject_types_supported:
  - pairwise
  audience: Target team members and trusted third parties with an existing Target relationship
  file: well-known/target-oauth-iam-target-openid-configuration.json
  x-evidence:
    fetched: '2026-08-27'
    url: https://oauth.iam.target.com/.well-known/openid-configuration
    http_status: 200
    content_type: application/json
    jwks_http_status: 200
- name: partnersOnlineOidc
  type: openIdConnect
  method: searched
  openIdConnectUrl: https://oauth.iam.partnersonline.com/.well-known/openid-configuration
  issuer: https://oauth.iam.partnersonline.com
  authorization_endpoint: https://oauth.iam.partnersonline.com/auth/oauth/v2/authorize
  token_endpoint: https://oauth.iam.partnersonline.com/auth/oauth/v2/token
  userinfo_endpoint: https://oauth.iam.partnersonline.com/openid/connect/v1/target/userinfo
  jwks_uri: https://oauth.iam.partnersonline.com/openid/connect/jwks.json
  registration_endpoint: https://oauth.iam.partnersonline.com/openid/connect/register
  grant_types_supported:
  - authorization_code
  - implicit
  response_types_supported:
  - code
  - token id_token
  scopes_supported:
  - openid
  - email
  - profile
  - openid_client_registration
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  id_token_signing_alg_values_supported:
  - RS256
  - HS256
  subject_types_supported:
  - pairwise
  audience: Target suppliers, vendors and Target Plus marketplace partners
  file: well-known/target-oauth-iam-partnersonline-openid-configuration.json
  x-evidence:
    fetched: '2026-08-27'
    url: https://oauth.iam.partnersonline.com/.well-known/openid-configuration
    http_status: 200
    content_type: application/json
- name: developerPortalApiKey
  type: apiKey
  in: header
  method: probed
  description: >-
    The developer.target.com catalog backend rejects anonymous calls with HTTP 401 and the body
    {"message":"Invalid Key","errors":[{"resource":"Go-Proxy","reason":"no API key ..."}]}, so an
    API key issued through the portal is the credential for the catalog itself. The header name is
    not disclosed anonymously.
  x-evidence:
    fetched: '2026-08-27'
    url: https://developer.target.com/api/docs/v1/docs/
    http_status: 401
    body_signature: 'message: Invalid Key / resource: Go-Proxy'
gaps:
- id: service-documentation-404
  detail: >-
    Both discovery documents advertise service_documentation (a Swagger definition for the OAuth v2
    service). Both URLs return 404. See well-known/target-well-known.yml findings[].
- id: no-rfc8414
  detail: Neither issuer serves /.well-known/oauth-authorization-server (both 404); discovery is OIDC-only.
unverified_prior_claims:
- scheme: bearerAuth
  detail: >-
    Earlier rounds derived an http/bearer JWT scheme from openapi/target-target-api-openapi.yml.
    That spec is an API Evangelist scaffold, not a Target-published contract (see
    openapi/PROVENANCE.md), so the bearer scheme is NOT carried forward as evidenced.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com