Upwind Authentication

generated: '2026-07-21'
method: searched
source: openapi/upwind-management-v1-openapi.yml, openapi/upwind-management-v2-openapi.yml
docs: https://docs.upwind.io/restapi/v1/introduction
summary:
  types:
  - oauth2
  oauth2_flows:
  - clientCredentials
schemes:
- name: OAuth2ClientCredentials
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.upwind.io/oauth/token
    scopes: 0
  description: 'OAuth 2.0 client credentials grant. Obtain client credentials in the Upwind
    Management Console, then exchange them for a JWT access token at https://auth.upwind.io/oauth/token
    with an audience matching the regional API host (https://api.upwind.io, https://api.eu.upwind.io,
    or https://api.me.upwind.io). Send the token as Authorization: Bearer <token>.'
  sources:
  - openapi/upwind-management-v1-openapi.yml
  - openapi/upwind-management-v2-openapi.yml
details:
  issuer: https://auth.upwind.io/ (Auth0-hosted; OIDC discovery at /.well-known/openid-configuration, see well-known/upwind-openid-configuration.json)
  token_format: JWT (Bearer authentication scheme)
  token_lifetime: All tokens automatically expire after 24 hours.
  audience_required: true
  audiences:
    - https://api.upwind.io
    - https://api.eu.upwind.io
    - https://api.me.upwind.io
  credential_types:
    - {type: Cloud account, usage: 'Establish a connection with a cloud service provider (AWS, GCP, Azure, Oracle)'}
    - {type: Sensor, usage: Deploy an Upwind Sensor using Helm or Bash}
    - {type: API, usage: Use the Management REST API}
    - {type: Integration, usage: 'Third-party integrations (Slack, Kubernetes Audit Logs, GitHub Actions, ...)'}
  rbac: >-
    API credentials carry a scope and roles bounded by the creating member's own access (no
    privilege escalation); the scope of existing credentials is immutable — generate new
    credentials to change resource boundaries. Default limit of 20 credentials per organization.
  credentials_docs: https://docs.upwind.io/settings/credentials