Tuum · Authentication Profile

Tuum Authentication

Authentication

Tuum secures its APIs with http, oauth2, and mutualTLS across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, refreshToken, and tokenExchange flow(s).

CompanyCore BankingBanking as a ServicePaymentsLendingCardsFintechFinancial-Services

Methods: http, oauth2, mutualTLS Schemes: 2 OAuth flows: authorizationCode, clientCredentials, refreshToken, tokenExchange API key in: header

Security Schemes

TuumJwt apiKey

· in: header ()

TuumOAuth2 oauth2

Source

Authentication Profile

generated: '2026-07-21'
method: searched
source: https://docs.tuum.com/tuum-developer-docs/getting-started/api-call-essentials/authentication-and-token-refresh.md
docs: https://docs.tuum.com/tuum-developer-docs/getting-started/api-call-essentials
summary:
  types: [http, oauth2, mutualTLS]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken, tokenExchange]
  notes: >-
    Two coexisting models. (1) The primary/legacy Tuum API auth is a proprietary
    JWT scheme: authenticate with username + password against the Auth API to
    receive a JSON Web Token, then present it in the custom x-auth-token request
    header on every subsequent call. (2) The auth-api host also runs a standards
    OAuth 2.0 / RFC 8414 authorization server (used for OAuth2 client-credentials
    webhook delivery and modern integrations) supporting PKCE, DPoP, mTLS-bound
    tokens, and token exchange.
schemes:
  - name: TuumJwt
    type: apiKey
    in: header
    parameter_name: x-auth-token
    description: >-
      JSON Web Token obtained from POST /api/v1/authorise (Auth API) using
      assigned employee/API-user credentials; refreshed via
      POST /api/v1/authorise/refresh. Presented as the x-auth-token header.
    token_endpoint: https://[api-name].[environment].tuumplatform.com/api/v1/authorise
    refresh_endpoint: https://[api-name].[environment].tuumplatform.com/api/v1/authorise/refresh
    reference: https://developer.tuumplatform.com/explore#auth-api_post_/api/v1/authorise
    sources: [docs]
  - name: TuumOAuth2
    type: oauth2
    description: >-
      RFC 8414 OAuth 2.0 authorization server advertised at
      /.well-known/oauth-authorization-server on the auth-api host.
    issuer: https://auth-api.sandbox.tuumplatform.com
    authorization_endpoint: https://auth-api.sandbox.tuumplatform.com/oauth2/authorize
    token_endpoint: https://auth-api.sandbox.tuumplatform.com/oauth2/token
    jwks_uri: https://auth-api.sandbox.tuumplatform.com/oauth2/jwks
    introspection_endpoint: https://auth-api.sandbox.tuumplatform.com/oauth2/introspect
    revocation_endpoint: https://auth-api.sandbox.tuumplatform.com/oauth2/revoke
    grant_types: [authorization_code, client_credentials, refresh_token, 'urn:ietf:params:oauth:grant-type:token-exchange']
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth, self_signed_tls_client_auth]
    pkce: [S256]
    dpop: true
    mtls_bound_access_tokens: true
    source: well-known/tuum-oauth-authorization-server.json
    sources: [well-known]
webhook_authentication:
  # Options Tuum applies to OUTBOUND webhook requests so your receiver can verify them.
  source: https://docs.tuum.com/tuum-developer-docs/getting-started/notification-api/webhooks/webhook-security-options.md
  options:
    - bearer-token
    - custom-auth-header
    - oauth2-client-credentials
    - hmac-signature
    - mtls

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/tuum-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.