Tuum · Authentication Profile

Tuum Authentication

Authentication

Tuum secures its APIs with http, oauth2, and mutualTLS across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, refreshToken, and tokenExchange flow(s).

CompanyCore BankingBanking as a ServicePaymentsLendingCardsFintechFinancial ServicesAPI
Methods: http, oauth2, mutualTLS Schemes: 2 OAuth flows: authorizationCode, clientCredentials, refreshToken, tokenExchange API key in: header

Security Schemes

TuumJwt apiKey
· in: header ()
TuumOAuth2 oauth2

Source

Authentication Profile

tuum-authentication.yml Raw ↑ 
generated: '2026-07-21'
method: searched
source: https://docs.tuum.com/tuum-developer-docs/getting-started/api-call-essentials/authentication-and-token-refresh.md
docs: https://docs.tuum.com/tuum-developer-docs/getting-started/api-call-essentials
summary:
  types: [http, oauth2, mutualTLS]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken, tokenExchange]
  notes: >-
    Two coexisting models. (1) The primary/legacy Tuum API auth is a proprietary
    JWT scheme: authenticate with username + password against the Auth API to
    receive a JSON Web Token, then present it in the custom x-auth-token request
    header on every subsequent call. (2) The auth-api host also runs a standards
    OAuth 2.0 / RFC 8414 authorization server (used for OAuth2 client-credentials
    webhook delivery and modern integrations) supporting PKCE, DPoP, mTLS-bound
    tokens, and token exchange.
schemes:
  - name: TuumJwt
    type: apiKey
    in: header
    parameter_name: x-auth-token
    description: >-
      JSON Web Token obtained from POST /api/v1/authorise (Auth API) using
      assigned employee/API-user credentials; refreshed via
      POST /api/v1/authorise/refresh. Presented as the x-auth-token header.
    token_endpoint: https://[api-name].[environment].tuumplatform.com/api/v1/authorise
    refresh_endpoint: https://[api-name].[environment].tuumplatform.com/api/v1/authorise/refresh
    reference: https://developer.tuumplatform.com/explore#auth-api_post_/api/v1/authorise
    sources: [docs]
  - name: TuumOAuth2
    type: oauth2
    description: >-
      RFC 8414 OAuth 2.0 authorization server advertised at
      /.well-known/oauth-authorization-server on the auth-api host.
    issuer: https://auth-api.sandbox.tuumplatform.com
    authorization_endpoint: https://auth-api.sandbox.tuumplatform.com/oauth2/authorize
    token_endpoint: https://auth-api.sandbox.tuumplatform.com/oauth2/token
    jwks_uri: https://auth-api.sandbox.tuumplatform.com/oauth2/jwks
    introspection_endpoint: https://auth-api.sandbox.tuumplatform.com/oauth2/introspect
    revocation_endpoint: https://auth-api.sandbox.tuumplatform.com/oauth2/revoke
    grant_types: [authorization_code, client_credentials, refresh_token, 'urn:ietf:params:oauth:grant-type:token-exchange']
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, self_signed_tls_client_auth]
    pkce: [S256]
    dpop: true
    mtls_bound_access_tokens: true
    source: well-known/tuum-oauth-authorization-server.json
    sources: [well-known]
webhook_authentication:
  # Options Tuum applies to OUTBOUND webhook requests so your receiver can verify them.
  source: https://docs.tuum.com/tuum-developer-docs/getting-started/notification-api/webhooks/webhook-security-options.md
  options:
    - bearer-token
    - custom-auth-header
    - oauth2-client-credentials
    - hmac-signature
    - mtls