Tesser Authentication

generated: '2026-07-21'
method: searched
source: https://docs.tesser.xyz/overviews/authentication
docs: https://docs.tesser.xyz/overviews/authentication
summary:
  types: [oauth2, http]
  scheme: bearer
  bearer_format: JWT
  oauth2_flows: [clientCredentials]
  identity_provider: Auth0
description: >-
  Every request to the Tesser API must carry a JWT access token. Tokens are
  minted via the OAuth 2.0 client-credentials grant against Tesser's Auth0
  tenant. Each workspace has a Client ID + Client Secret pair (Dashboard ->
  Settings > API Keys). The token is presented as an HTTP bearer token. The
  OpenAPI declares a single `bearer` (http/bearer, JWT) security scheme applied
  globally.
schemes:
  - name: bearer
    type: http
    scheme: bearer
    bearer_format: JWT
    applied: global
    sources: [openapi/tesser-openapi-original.json]
token_endpoints:
  - environment: production
    url: https://auth.tesser.xyz/oauth/token
    audience: https://api.tesser.xyz
    grant_type: client_credentials
    authorization_server: https://tesser-payments.us.auth0.com
    token_lifetime_seconds: 86400
  - environment: sandbox
    audience: https://sandbox.tesserx.co
    grant_type: client_credentials
    authorization_server: https://dev-awqy75wdabpsnsvu.us.auth0.com
token_request_body:
  client_id: YOUR_CLIENT_ID
  client_secret: YOUR_CLIENT_SECRET
  audience: https://api.tesser.xyz
  grant_type: client_credentials
token_response_fields:
  - {field: access_token, description: JWT to include in the Authorization header}
  - {field: token_type, description: Always "Bearer"}
  - {field: expires_in, description: Token lifetime in seconds (default 86400 = 24h)}
usage:
  header: Authorization
  format: 'Bearer <access_token>'
credentials_location: https://app.tesser.xyz (Settings > API Keys)
notes: >-
  OAuth Protected Resource metadata (RFC 9728) is served at
  /.well-known/oauth-protected-resource on both api.tesser.xyz and
  sandbox.tesserx.co, advertising the Auth0 authorization server so MCP/OAuth
  clients can auto-discover the auth flow. No fine-grained OAuth scopes are
  documented; access is audience-scoped per environment.