Virto Commerce · Authentication Profile

Virto Commerce Authentication

Authentication

Virto Commerce secures its APIs with apiKey, http, and oauth2 across 5 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials and password flow(s).

B2B eCommerceCatalog ManagementOrder ManagementPricingInventoryShopping CartCustomer ManagementMarketingPaymentsShippingSubscriptionHeadless CommerceOpen-Source.NETWebhookEvent-DrivenCloudEventsGraphQLReturnsMCPB2B Quotes
Methods: apiKey, http, oauth2 Schemes: 5 OAuth flows: clientCredentials, password API key in: header, query

Security Schemes

oauth2 oauth2
· flows: password, clientCredentials
api_key apiKey
· in: query (api_key)
api_key_header apiKey
· in: header (api_key)
http-signature http
scheme: signature
basic http
scheme: basic

Source

Authentication Profile

Raw ↑ 
generated: '2026-08-13'
method: searched
source: 'openapi/virto-commerce-catalog-api-openapi.yml, openapi/virto-commerce-companies-and-contacts-api-openapi.yml,
  openapi/virto-commerce-event-bus-api-openapi.yml, openapi/virto-commerce-inventory-api-openapi.yml,
  openapi/virto-commerce-marketing-api-openapi.yml, openapi/virto-commerce-order-management-api-openapi.yml,
  openapi/virto-commerce-pricing-api-openapi.yml, openapi/virto-commerce-quotes-api-openapi.yml, openapi/virto-commerce-returns-api-openapi.yml,
  openapi/virto-commerce-shopping-cart-api-openapi.yml, openapi/virto-commerce-store-api-openapi.yml,
  openapi/virto-commerce-virtocommerce-platform-api-openapi.yml ...

  ; upgraded 2026-08-13 from the live discovery document https://virtostart-demo-admin.govirto.com/.well-known/openid-configuration
  (HTTP 200, captured in well-known/virto-commerce-openid-configuration.json) and https://docs.virtocommerce.org/platform/developer-guide/Fundamentals/Security/authentication/api-key-authentication/'
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  - query
  oauth2_flows:
  - clientCredentials
  - password
schemes:
- name: oauth2
  type: oauth2
  flows:
  - flow: password
    tokenUrl: /connect/token
    scopes: 0
  - flow: clientCredentials
    tokenUrl: /connect/token
    scopes: 0
  description: OAuth2 Resource Owner Password Grant flow
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
- name: api_key
  type: apiKey
  in: query
  parameter: api_key
  description: API Key authentication
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
- name: api_key_header
  type: apiKey
  in: header
  parameter: api_key
  description: API Key authentication (alternative via header)
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
- name: http-signature
  type: http
  scheme: signature
  description: HTTP Signature authentication using Authorization header
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
- name: basic
  type: http
  scheme: basic
  description: Basic authentication using username and password
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
docs: https://docs.virtocommerce.org/platform/developer-guide/Fundamentals/Security/authentication/api-key-authentication/
deployment_note: 'Virto Commerce is self-hosted: the authorization server is the operator''s own platform
  instance, running OpenIddict. All endpoints below are relative to that host. The issuer recorded here
  is Virto''s own public reference deployment.'
discovery:
  openid_configuration: well-known/virto-commerce-openid-configuration.json
  oauth_authorization_server: well-known/virto-commerce-oauth-authorization-server.json
  issuer: https://virtostart-demo-admin.govirto.com/
  authorization_endpoint: /connect/authorize
  token_endpoint: /connect/token
  userinfo_endpoint: /connect/userinfo
  end_session_endpoint: /connect/logout
  jwks_uri: /.well-known/jwks
  jwks_note: Non-conventional path — /.well-known/jwks, not jwks.json. Served, HTTP 200.
  grant_types_supported:
  - password
  - refresh_token
  - client_credentials
  - authorization_code
  - impersonate
  - external_sign_in
  grant_types_note: impersonate and external_sign_in are Virto-specific grants beyond the four the OpenAPI
    declares; the spec only shows password and client_credentials.
  code_challenge_methods_supported:
  - plain
  - S256
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - private_key_jwt
  - client_secret_basic
  id_token_signing_alg_values_supported:
  - RS256
  response_types_supported:
  - code
  scopes_supported:
  - openid
  - offline_access
  require_pushed_authorization_requests: false
  mtls_bound_tokens: false
api_key:
  schemes:
  - api_key_header (header)
  - api_key (query string)
  recommended: api_key_header
  warning: The query-string variant places a credential in access logs and proxy history; prefer the header.
  used_by: Virto's own MCP adapter authenticates with a platform API key in the api_key header.
authorization_model:
  mechanism: platform permissions, not OAuth scopes
  note: scopes_supported is openid + offline_access only. Access control is Virto's fine-grained permission
    system — colon-namespaced strings such as webhooks:read, webhooks:update, webhooks:feed:read — granted
    to roles. Permissions are NOT expressed in the OpenAPI, so a client cannot discover the permission
    an operation needs; a 403 comes back with an empty body.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/virto-commerce-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.