Usertesting Authentication

generated: '2026-07-21'
method: searched
source: openapi/usertesting-legacy-v1-openapi.yml, openapi/usertesting-results-v2-openapi.yml
docs: https://developer.usertesting.com/docs/authorization
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - clientCredentials
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: Go to [Authorization](https://developer.usertesting.com/v1.0/docs/authentication-authorization)
    for information on how to generate an access token.
  sources:
  - openapi/usertesting-legacy-v1-openapi.yml
  - openapi/usertesting-results-v2-openapi.yml
- name: oauth2ClientCredentials
  type: oauth2
  description: >-
    Documented token flow behind bearerAuth (the OpenAPI models only the resulting bearer
    token). Client credentials (client_id + client_secret) are issued per registered API user
    by support@usertesting.com; the same token works on both Legacy (v1) and Results (v2)
    endpoints. Access tokens are JWTs that expire after 3600 seconds. The Okta authorization
    server publishes RFC 8414 / OIDC discovery metadata (saved under well-known/).
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.usertesting.com/oauth2/aus1p3vtd8vtm4Bxv0h8/v1/token
    scopes:
      studies:read: Read access to study/test result data
  sources:
  - https://developer.usertesting.com/docs/authorization
  - well-known/usertesting-oauth-authorization-server.json
notes:
- 'Request header: Authorization: Bearer ACCESS_TOKEN on every API call.'
- 'Token request: POST x-www-form-urlencoded with grant_type=client_credentials, client_id,
  client_secret, scope=studies:read.'
- API access is scoped to the workspaces where the registered email is a team member.