Treez Authentication

generated: '2026-08-30'
method: searched
docs: https://code.treez.io/reference/authentication
source: >-
  https://code.treez.io/reference/authentication (self-signed JWT scheme, current v3 APIs) and
  https://code.treez.io/docs/authorization-2 (legacy client-ID/API-key Authorization API for the
  SellTreez v2 surface). Neither is expressible from the OpenAPI documents: all seven published
  definitions declare an EMPTY components.securitySchemes and no security[] requirement, so a
  derive-only pass (0-working/derive-authentication.py) returns nothing. This file is the
  documented reality the specs omit.
summary:
  auth_types: [jwt-self-signed, api-key]
  primary: jwt-self-signed
  oauth2: false
  openid_connect: false
  mutual_tls: false
  api_key_locations: [header]
  spec_declared: false
  spec_gap: >-
    All 7 OpenAPI definitions omit securitySchemes entirely. An agent reading only the contract
    cannot tell how to authenticate; it must read the prose auth page.
schemes:
- id: self-signed-jwt
  type: http
  scheme: bearer-like
  in: header
  name: Authorization
  applies_to:
  - openapi/treez-dispensary-openapi.json
  - openapi/treez-catalog-openapi.json
  - openapi/treez-discount-openapi.json
  - openapi/treez-tag-openapi.json
  - openapi/treez-collections-openapi.json
  - openapi/treez-jwt-check-openapi.json
  standard: RFC 7519 (JSON Web Token)
  description: >-
    Every request to the v3 Dispensary and Service APIs carries a self-signed JWT in the
    Authorization header. The integrator generates an RSA-4096 key pair, sends the public key
    (.crt) to api-support@treez.io, and Treez returns a Certificate ID bound to a record listing
    the organizations, dispensaries and endpoints that integrator is entitled to call. Requests
    are signed with the corresponding private key using RSA-SHA256; the token value is
    base64url(header) + "." + base64(signature).
  header_format: 'Authorization: <base64url-encoded-claims>.<base64-RSA-SHA256-signature>'
  claims:
    aud: The exact API endpoint URL being called
    iss: Certificate ID (the integrator identifier Treez issues against the stored public key)
    oid: Organization ID (GUID of the organization the call is destined for)
    iat: Issued-at, in MILLISECONDS since epoch
    exp: Expiry, in milliseconds - must be iat + 30000
    jti: Recommended unique token id to prevent replay
  ttl:
    value_ms: 30000
    enforced: true
    on_violation: HTTP 400
    note: Treez enforces a 30,000 ms TTL; a TTL outside that range returns a 400.
  key_management:
    algorithm: RSA
    key_size: 4096
    signature: SHA256withRSA
    generation: 'openssl req -new -newkey rsa:4096 -x509 -sha256 -days 1825 -noenc -out public.crt -keyout private.key'
    public_key_delivery: email the .crt to api-support@treez.io
    rotation: >-
      Access to additional organizations, dispensaries and endpoints is added or revoked by
      updating the certificate record Treez holds against the public key. The docs do not state
      a rotation cadence or a self-service key-rotation endpoint.
  scoping: >-
    One certificate can be granted access to many organizations and dispensaries; the docs call
    this a "flexible one-to-many design" that removes the need for a per-dispensary API key.
  validation_endpoint:
    operationId: post_jwt-validation
    method: POST
    url: https://api-prod.treez.io/service/jwt-validation
    spec: openapi/treez-jwt-check-openapi.json
    description: Check the validity of a signed JWT and view the resources it has been granted access to.
- id: legacy-client-id-api-key
  type: apiKey
  in: header
  status: legacy
  applies_to:
  - openapi/treez-product-api-openapi.json
  description: >-
    The legacy SellTreez v2 surface (api.treez.io/v2.0/dispensary, the Product API) uses an
    Authorization API that exchanges a partner client ID plus a per-location API key for an access
    token. Client IDs are issued once per partner at onboarding and never change; a separate API
    key is generated for each Treez retail location the partner integrates with, and production
    keys are only issued after the partner completes certification.
  token:
    lifetime: 2 hours
    note: >-
      Treez requires certified partners to call the Authorization API only when the current token
      expires or shortly before; inefficient re-authentication is grounds for refusing
      certification.
  credential_issuance: >-
    Mutual customers request a production API key on the partner's behalf via Treez support
    (https://support.treez.io/).
onboarding:
  self_serve: false
  gate: partner application + MNDA + API Usage Agreement + certification
  application_url: https://www.treez.io/partner-application
  process_url: https://code.treez.io/page/partner-with-us
  agreement_url: https://code.treez.io/page/legal
  sandbox_before_production: true
  contacts:
    partnerships: partners@treez.io
    technical: api-support@treez.io
    support: support@treez.io