Telia Authentication

generated: '2026-07-25'
method: searched
source: openapi/telia-lso-sonata-site-management.yml
docs:
- https://cdn.messaging.teliacompany.com/documents/developer/index.html
- https://tunnistus.telia.fi/.well-known/openid-configuration
- https://github.com/telia-oss/ace-audio-stream-forwarding-api
- https://github.com/telia-oss/ace-knowledge-docs/blob/master/REST/webhook.md
notes: >-
  Upgraded from the derived OpenAPI-only profile. Telia runs five different
  authentication models across seven surfaces, and only one of them (oauth2
  client credentials on LSO Sonata) is expressed in a machine-readable contract.
  Every model below is documented on a public Telia surface.
summary:
  types:
  - oauth2
  - http-basic
  - mutualTLS
  - openIdConnect
  - ip-allowlist
  - smpp-bind
  oauth2_flows:
  - clientCredentials
  api_key_in: []
  scopes_published: false
  self_serve_credentials: false
schemes:
- name: prodBearerAuth
  type: oauth2
  surface: LSO Sonata Geographic Site Management (production)
  flows:
  - flow: clientCredentials
    tokenUrl: https://api-garden.teliacompany.com/v4/oauth/client_credential/accesstoken
    scopes: 0
  description: Token endpoint for the production environment
  sources:
  - openapi/telia-lso-sonata-site-management.yml
- name: testBearerAuth
  type: oauth2
  surface: LSO Sonata Geographic Site Management (test and sandbox)
  flows:
  - flow: clientCredentials
    tokenUrl: https://api-garden-test.teliacompany.com/v4/oauth/client_credential/accesstoken
    scopes: 0
  description: Token endpoint for all test environments
  sources:
  - openapi/telia-lso-sonata-site-management.yml
- name: bulkMessagingBasic
  type: http
  scheme: basic
  surface: Bulk Messaging SMS REST API
  base_url: https://api.messaging.teliacompany.com/sms/rest/v2
  credential_source: created by a user with the Technical role in the Bulk Messaging
    web portal, under Services -> Technical Configuration
  evidence: public implementation guide, cURL example with an Authorization Basic
    header
  probe: https://api.messaging.teliacompany.com/sms/rest/v2/* returns HTTP 401 to
    an anonymous caller, confirming the challenge is live
  sources:
  - https://cdn.messaging.teliacompany.com/documents/developer/index.html
- name: bulkMessagingCallbackBasic
  type: http
  scheme: basic
  surface: Bulk Messaging SMS Callback API (customer-implemented)
  direction: inbound to the customer
  credential_source: callback address and callback credentials are registered by
    the customer in the Bulk Messaging portal
  sources:
  - https://cdn.messaging.teliacompany.com/documents/developer/index.html
- name: smppBind
  type: smpp-bind
  surface: Bulk Messaging SMPP API
  endpoint: smpp.messaging.teliacompany.com:3550
  fields:
  - system_id (username)
  - password
  interface_version: '0x34'
  transport_security: TLS 1.2 minimum, SNI required, fixed cipher list
  additional_control: static source IP addresses must be whitelisted in Telia's ACL
    by the Bulk Messaging Support team
  sources:
  - https://cdn.messaging.teliacompany.com/documents/developer/index.html
- name: aceAudioStreamMtls
  type: mutualTLS
  surface: Telia ACE Audio Stream Forwarding (gRPC)
  description: Telia connects outbound to a customer-implemented receiver and
    authenticates with client certificates
  sources:
  - https://github.com/telia-oss/ace-audio-stream-forwarding-api
- name: tunnistusOidc
  type: openIdConnect
  surface: Telia Tunnistus identification broker (Telia Finland)
  issuer: https://tunnistus.telia.fi/uas
  openIdConnectUrl: https://tunnistus.telia.fi/.well-known/openid-configuration
  discovery_document: well-known/telia-openid-configuration.json
  endpoints:
    authorization: https://tunnistus.telia.fi/uas/oauth2/authorization
    token: https://tunnistus.telia.fi/uas/oauth2/token
    userinfo: https://tunnistus.telia.fi/uas/oauth2/userinfo
    jwks: https://tunnistus.telia.fi/uas/oauth2/metadata.jwks
    introspection: https://tunnistus.telia.fi/uas/oauth2/introspection
    revocation: https://tunnistus.telia.fi/uas/oauth2/revocation
  grant_types:
  - authorization_code
  - password
  - client_credentials
  - refresh_token
  - urn:ietf:params:oauth:grant-type:saml2-bearer
  - http://globalsign.com/iam/sso/oauth2/grant-type/sms-mt-otp
  - http://globalsign.com/iam/sso/oauth2/grant-type/smtp-otp
  scopes:
  - openid
  - userinfo
  token_endpoint_auth_methods:
  - client_secret_post
  - client_secret_basic
  - client_secret_jwt
  - private_key_jwt
  - none
  id_token_signing_alg:
  - RS256
  - HS256
  ciba: false
  ciba_note: no backchannel_authentication_endpoint is advertised; CIBA is the
    grant CAMARA specifies for network-based authorization, so no CIBA-capable
    authorization server is publicly discoverable on Telia's estate
  sources:
  - https://tunnistus.telia.fi/.well-known/openid-configuration
- name: aceKnowledgeWebhookSignature
  type: request-signing
  surface: ACE Knowledge contact-method webhook (outbound to the customer)
  header: X-ACE-Signature
  algorithm: HMAC SHA256 (JWT)
  claims:
  - iss
  - aud
  - exp
  - iat
  - content_hash
  - method
  - path
  optional: true
  note: enabled per contact method by the editor, with a shared secret; Telia
    recommends a secret of at least 32 characters
  sources:
  - https://github.com/telia-oss/ace-knowledge-docs/blob/master/REST/webhook.md
onboarding:
  self_serve: false
  requirements:
  - an existing Telia commercial agreement
  - a whitelisted corporate email domain
  - manual support approval of the developer account
  - a second approval of the registered application
  - a separate fee agreement per API (Telia Developer's Toolbox terms of use)