Tegus · Authentication Profile

Tegus Authentication

Authentication

Tegus secures its APIs with openIdConnect and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, implicit, password, refreshToken, deviceCode, and tokenExchange flow(s).

Investment ResearchExpert NetworksMarket IntelligenceFinancial DataTranscriptsPrivate MarketsEquity ResearchOpenID ConnectAcquired
Methods: openIdConnect, oauth2 Schemes: 2 OAuth flows: authorizationCode, clientCredentials, implicit, password, refreshToken, deviceCode, tokenExchange API key in:

Security Schemes

TegusOpenIDConnect openIdConnect
TegusOAuth2 oauth2

Source

Authentication Profile

tegus-authentication.yml Raw ↑ 
generated: '2026-08-05'
method: probed
source: https://auth.tegus.com/.well-known/openid-configuration
docs: https://auth.tegus.com/.well-known/openid-configuration
note: >-
  Derived entirely from the live OpenID Connect Discovery and RFC 8414 metadata served
  by auth.tegus.com. There is no published Tegus API reference to corroborate against —
  the Tegus developer hub (tegus.readme.io) now 302s to /inactive and the product API
  hosts no longer resolve. This profile therefore describes the identity layer of the
  Tegus platform, not a product API contract.
summary:
  types:
  - openIdConnect
  - oauth2
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - implicit
  - password
  - refreshToken
  - deviceCode
  - tokenExchange
  pkce: true
  pkce_methods:
  - S256
  - plain
  dpop: true
  mtls: false
  api_key_in: []
schemes:
- name: TegusOpenIDConnect
  type: openIdConnect
  openIdConnectUrl: https://auth.tegus.com/.well-known/openid-configuration
  issuer: https://auth.tegus.com/
  sources:
  - well-known/tegus-openid-configuration.json
- name: TegusOAuth2
  type: oauth2
  issuer: https://auth.tegus.com/
  endpoints:
    authorization: https://auth.tegus.com/authorize
    token: https://auth.tegus.com/oauth/token
    userinfo: https://auth.tegus.com/userinfo
    jwks: https://auth.tegus.com/.well-known/jwks.json
    revocation: https://auth.tegus.com/oauth/revoke
    registration: https://auth.tegus.com/oidc/register
    device_authorization: https://auth.tegus.com/oauth/device/code
    backchannel_authentication: https://auth.tegus.com/bc-authorize
    mfa_challenge: https://auth.tegus.com/mfa/challenge
    global_token_revocation: https://auth.tegus.com/oauth/global-token-revocation/connection/{connectionName}
  grant_types:
  - client_credentials
  - authorization_code
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code
  response_types:
  - code
  - token
  - id_token
  - code token
  - code id_token
  - token id_token
  - code token id_token
  response_modes:
  - query
  - fragment
  - form_post
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  token_endpoint_auth_signing_algs:
  - RS256
  - RS384
  - PS256
  id_token_signing_algs:
  - HS256
  - RS256
  - PS256
  dpop_signing_algs:
  - ES256
  code_challenge_methods:
  - S256
  - plain
  dynamic_client_registration: true
  backchannel_logout_supported: true
  request_parameter_supported: false
  request_uri_parameter_supported: false
  sources:
  - well-known/tegus-oauth-authorization-server.json
observations:
- id: implicit-grant-enabled
  detail: >-
    The implicit grant and the resource-owner password grant are both advertised in
    grant_types_supported. Both are discouraged by OAuth 2.1 / BCP 225.
- id: plain-pkce-allowed
  detail: >-
    code_challenge_methods_supported includes "plain" alongside S256.
- id: hs256-id-tokens
  detail: >-
    id_token_signing_alg_values_supported includes the symmetric HS256 alongside RS256/PS256.
x-evidence:
  fetched: '2026-08-05'
  url: https://auth.tegus.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json