Trulioo · Authentication Profile

Trulioo Authentication

Authentication

Trulioo secures its APIs with oauth2, http, and mutualTLS across 4 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and authorizationCode (MCP, PKCE) flow(s).

Identity VerificationKYCKYBAMLWatchlist ScreeningBiometricsDocument VerificationFraud PreventionComplianceGlobal Identity
Methods: oauth2, http, mutualTLS Schemes: 4 OAuth flows: clientCredentials, authorizationCode (MCP, PKCE) API key in:

Security Schemes

OAuth2 oauth2
· flows: clientCredentials
BasicAuth http
scheme: basic
MutualTLS mutualTLS
MCP OAuth 2.1 oauth2
· flows: authorizationCode, clientCredentials

Source

Authentication Profile

Raw ↑ 
generated: '2026-10-08'
method: searched
source:
- openapi/trulioo-authentication-api-openapi.yml, openapi/trulioo-business-configuration-api-openapi.yml, openapi/trulioo-business-reports-api-openapi.yml,
  openapi/trulioo-business-search-api-openapi.yml, openapi/trulioo-business-verification-api-openapi.yml, openapi/trulioo-configuration-api-openapi.yml,
  openapi/trulioo-connection-api-openapi.yml, openapi/trulioo-document-configuration-api-openapi.yml, openapi/trulioo-document-verification-api-openapi.yml,
  openapi/trulioo-documents-api-openapi.yml, openapi/trulioo-end-clients-api-openapi.yml, openapi/trulioo-events-api-openapi.yml
  ...
- https://developer.trulioo.com/reference/authentication.md
- https://developer.trulioo.com/reference/keys-and-authentication-2.md
- https://developer.trulioo.com/reference/connecting-to-trulioos-api-using-mutual-tls.md
- https://developer.trulioo.com/reference/hmac.md
- https://mcp.trulioo.com/developer/index.md
- https://mcp.trulioo.com/.well-known/oauth-authorization-server (probed)
summary:
  types:
  - oauth2
  - http
  - mutualTLS
  oauth2_flows:
  - clientCredentials
  - authorizationCode (MCP, PKCE)
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://api.trulioo.com/customer/v2/auth/customer
    scopes: 0
  sources:
  - openapi/trulioo-authentication-api-openapi.yml
  - openapi/trulioo-business-configuration-api-openapi.yml
  - openapi/trulioo-business-reports-api-openapi.yml
  - openapi/trulioo-business-search-api-openapi.yml
  - openapi/trulioo-business-verification-api-openapi.yml
  - openapi/trulioo-configuration-api-openapi.yml
  - openapi/trulioo-connection-api-openapi.yml
  - openapi/trulioo-document-configuration-api-openapi.yml
  - openapi/trulioo-document-verification-api-openapi.yml
  - openapi/trulioo-documents-api-openapi.yml
  - openapi/trulioo-end-clients-api-openapi.yml
  - openapi/trulioo-events-api-openapi.yml
  - openapi/trulioo-flows-api-openapi.yml
  - openapi/trulioo-known-faces-api-openapi.yml
  - openapi/trulioo-person-fraud-api-openapi.yml
  - openapi/trulioo-sessions-api-openapi.yml
  - openapi/trulioo-transactions-api-openapi.yml
  - openapi/trulioo-verifications-api-openapi.yml
  - openapi/trulioo-workflows-api-openapi.yml
  docs: https://developer.trulioo.com/reference/authentication
  documented_token_endpoints:
  - https://auth-api.trulioo.com/connect/token (grant_type=client_credentials, scope=napi.api; Normalized API v3
    / GlobalGateway)
  - https://api.trulioo.com/customer/v2/auth/customer (postAuthCustomer; Trulioo Platform / Workflow Studio, access
    tokens expire in one hour, refresh endpoint available)
  credential_issuance: Client Id and Client Secret are provided by the Customer Success Manager; no self-serve key
    creation
  scopes_documented:
  - napi.api
  - workflow.studio.api (authentication recipe)
- name: BasicAuth
  type: http
  scheme: basic
  sources:
  - openapi/trulioo-business-configuration-api-openapi.yml
  - openapi/trulioo-business-reports-api-openapi.yml
  - openapi/trulioo-business-search-api-openapi.yml
  - openapi/trulioo-business-verification-api-openapi.yml
  - openapi/trulioo-configuration-api-openapi.yml
  - openapi/trulioo-connection-api-openapi.yml
  - openapi/trulioo-document-configuration-api-openapi.yml
  - openapi/trulioo-document-verification-api-openapi.yml
  - openapi/trulioo-documents-api-openapi.yml
  - openapi/trulioo-known-faces-api-openapi.yml
  - openapi/trulioo-person-fraud-api-openapi.yml
  - openapi/trulioo-transactions-api-openapi.yml
  - openapi/trulioo-verifications-api-openapi.yml
  note: Declared in the v3 contract as an alternative scheme; the docs describe OAuth bearer tokens as the Platform
    API V3 method
- name: MutualTLS
  type: mutualTLS
  docs: https://developer.trulioo.com/reference/connecting-to-trulioos-api-using-mutual-tls
  note: Mutual TLS client-certificate connection option documented for the API, configured with Trulioo support
  sources:
  - https://developer.trulioo.com/reference/connecting-to-trulioos-api-using-mutual-tls.md
- name: MCP OAuth 2.1
  type: oauth2
  flows:
  - flow: authorizationCode
    pkce: S256
    authorizationUrl: https://mcp.trulioo.com/authorize
    tokenUrl: https://mcp.trulioo.com/token
    registrationUrl: https://mcp.trulioo.com/register
    scopes:
    - read
    - verify
    - verification:create
    - kyb:submit
    - agent:write
    - domain:write
    - release:publish
    - release:revoke
    - sandbox:write
    note: 'Sandbox sessions: client-managed OAuth 2.1 with dynamic client registration'
  - flow: clientCredentials
    tokenUrl: https://mcp.trulioo.com/oauth/token
    note: 'Live integrations: HTTP Basic client_id:client_secret, grant_type=client_credentials -> bearer, expires_in
      3600, no refresh token'
  protected_resource: https://mcp.trulioo.com/.well-known/oauth-protected-resource/mcp
  docs: https://mcp.trulioo.com/developer/#auth
  sources:
  - https://mcp.trulioo.com/developer/index.md
  - https://mcp.trulioo.com/.well-known/oauth-authorization-server
docs: https://developer.trulioo.com/reference/authentication
webhook_authentication:
  header: x-trulioo-signature
  algorithm: HMAC-SHA256, hex
  docs: https://developer.trulioo.com/reference/hmac

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/trulioo-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.