Truveta · Authentication Profile

Truveta Authentication

Authentication

Truveta publishes no OpenAPI, so this profile is not derived from a spec. It is read directly from the OpenID Connect discovery document Truveta's own Auth0 identity tenant serves anonymously at login.truveta.com. This is the authentication surface in front of Truveta Studio; there is no separately documented public API to authenticate against.

Truveta secures its APIs with openIdConnect and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, deviceCode, refreshToken, and tokenExchange flow(s).

CompanyHealthcareHealth DataElectronic Health RecordsReal World EvidenceClinical ResearchLife SciencesGenomicsAnalyticsArtificial IntelligenceData Platform
Methods: openIdConnect, oauth2 Schemes: 2 OAuth flows: authorizationCode, clientCredentials, deviceCode, refreshToken, tokenExchange API key in:

Security Schemes

TruvetaOIDC openIdConnect
TruvetaOAuth2 oauth2

Source

Authentication Profile

truveta-authentication.yml Raw ↑ 
generated: '2026-08-05'
method: searched
source: https://login.truveta.com/.well-known/openid-configuration
docs: https://studio.truveta.com/
description: >-
  Truveta publishes no OpenAPI, so this profile is not derived from a spec. It
  is read directly from the OpenID Connect discovery document Truveta's own
  Auth0 identity tenant serves anonymously at login.truveta.com. This is the
  authentication surface in front of Truveta Studio; there is no separately
  documented public API to authenticate against.
summary:
  types: [openIdConnect, oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode, clientCredentials, deviceCode, refreshToken, tokenExchange]
  identity_provider: Auth0
  pkce: true
  mfa: true
schemes:
  - name: TruvetaOIDC
    type: openIdConnect
    openIdConnectUrl: https://login.truveta.com/.well-known/openid-configuration
    issuer: https://login.truveta.com/
    sources: [well-known/truveta-openid-configuration.json]
  - name: TruvetaOAuth2
    type: oauth2
    sources: [well-known/truveta-openid-configuration.json]
    endpoints:
      authorization: https://login.truveta.com/authorize
      token: https://login.truveta.com/oauth/token
      device_authorization: https://login.truveta.com/oauth/device/code
      userinfo: https://login.truveta.com/userinfo
      revocation: https://login.truveta.com/oauth/revoke
      registration: https://login.truveta.com/oidc/register
      end_session: https://login.truveta.com/oidc/logout
      jwks: https://login.truveta.com/.well-known/jwks.json
      backchannel_authentication: https://login.truveta.com/bc-authorize
      mfa_challenge: https://login.truveta.com/mfa/challenge
    grant_types:
      - authorization_code
      - client_credentials
      - refresh_token
      - implicit
      - password
      - urn:ietf:params:oauth:grant-type:device_code
      - urn:ietf:params:oauth:grant-type:token-exchange
      - urn:ietf:params:oauth:grant-type:jwt-bearer
      - http://auth0.com/oauth/grant-type/password-realm
      - http://auth0.com/oauth/grant-type/passwordless/otp
      - http://auth0.com/oauth/grant-type/mfa-oob
      - http://auth0.com/oauth/grant-type/mfa-otp
      - http://auth0.com/oauth/grant-type/mfa-recovery-code
    response_types: [code, token, id_token, code token, code id_token, token id_token, code token id_token]
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, private_key_jwt, none]
    code_challenge_methods: [S256, plain]
    id_token_signing_algs: [HS256, RS256, PS256]
    dpop_supported: true
    backchannel_logout_supported: true
    subject_types: [public]
claims_supported:
  - aud
  - auth_time
  - created_at
  - email
  - email_verified
  - exp
  - family_name
  - given_name
  - iat
  - identities
  - iss
  - name
  - nickname
  - phone_number
  - picture
  - sub
notes:
  - >-
    Access is customer-only. studio.truveta.com issues an HTTP 302 into the
    Auth0 universal login at login.truveta.com; there is no self-serve sign-up
    and no anonymous developer tier.
  - >-
    No API key, HTTP basic, HTTP bearer, or mutual-TLS scheme is documented
    anywhere on Truveta's public surface.
x-evidence:
  fetched: '2026-08-05'
  url: https://login.truveta.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json