Virto Commerce Authentication

generated: '2026-08-13'
method: searched
source: 'openapi/virto-commerce-catalog-api-openapi.yml, openapi/virto-commerce-companies-and-contacts-api-openapi.yml,
  openapi/virto-commerce-event-bus-api-openapi.yml, openapi/virto-commerce-inventory-api-openapi.yml,
  openapi/virto-commerce-marketing-api-openapi.yml, openapi/virto-commerce-order-management-api-openapi.yml,
  openapi/virto-commerce-pricing-api-openapi.yml, openapi/virto-commerce-quotes-api-openapi.yml, openapi/virto-commerce-returns-api-openapi.yml,
  openapi/virto-commerce-shopping-cart-api-openapi.yml, openapi/virto-commerce-store-api-openapi.yml,
  openapi/virto-commerce-virtocommerce-platform-api-openapi.yml ...

  ; upgraded 2026-08-13 from the live discovery document https://virtostart-demo-admin.govirto.com/.well-known/openid-configuration
  (HTTP 200, captured in well-known/virto-commerce-openid-configuration.json) and https://docs.virtocommerce.org/platform/developer-guide/Fundamentals/Security/authentication/api-key-authentication/'
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  - query
  oauth2_flows:
  - clientCredentials
  - password
schemes:
- name: oauth2
  type: oauth2
  flows:
  - flow: password
    tokenUrl: /connect/token
    scopes: 0
  - flow: clientCredentials
    tokenUrl: /connect/token
    scopes: 0
  description: OAuth2 Resource Owner Password Grant flow
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
- name: api_key
  type: apiKey
  in: query
  parameter: api_key
  description: API Key authentication
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
- name: api_key_header
  type: apiKey
  in: header
  parameter: api_key
  description: API Key authentication (alternative via header)
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
- name: http-signature
  type: http
  scheme: signature
  description: HTTP Signature authentication using Authorization header
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
- name: basic
  type: http
  scheme: basic
  description: Basic authentication using username and password
  sources:
  - openapi/virto-commerce-catalog-api-openapi.yml
  - openapi/virto-commerce-companies-and-contacts-api-openapi.yml
  - openapi/virto-commerce-event-bus-api-openapi.yml
  - openapi/virto-commerce-inventory-api-openapi.yml
  - openapi/virto-commerce-marketing-api-openapi.yml
  - openapi/virto-commerce-order-management-api-openapi.yml
  - openapi/virto-commerce-pricing-api-openapi.yml
  - openapi/virto-commerce-quotes-api-openapi.yml
  - openapi/virto-commerce-returns-api-openapi.yml
  - openapi/virto-commerce-shopping-cart-api-openapi.yml
  - openapi/virto-commerce-store-api-openapi.yml
  - openapi/virto-commerce-virtocommerce-platform-api-openapi.yml
  - openapi/virto-commerce-webhooks-api-openapi.yml
docs: https://docs.virtocommerce.org/platform/developer-guide/Fundamentals/Security/authentication/api-key-authentication/
deployment_note: 'Virto Commerce is self-hosted: the authorization server is the operator''s own platform
  instance, running OpenIddict. All endpoints below are relative to that host. The issuer recorded here
  is Virto''s own public reference deployment.'
discovery:
  openid_configuration: well-known/virto-commerce-openid-configuration.json
  oauth_authorization_server: well-known/virto-commerce-oauth-authorization-server.json
  issuer: https://virtostart-demo-admin.govirto.com/
  authorization_endpoint: /connect/authorize
  token_endpoint: /connect/token
  userinfo_endpoint: /connect/userinfo
  end_session_endpoint: /connect/logout
  jwks_uri: /.well-known/jwks
  jwks_note: Non-conventional path — /.well-known/jwks, not jwks.json. Served, HTTP 200.
  grant_types_supported:
  - password
  - refresh_token
  - client_credentials
  - authorization_code
  - impersonate
  - external_sign_in
  grant_types_note: impersonate and external_sign_in are Virto-specific grants beyond the four the OpenAPI
    declares; the spec only shows password and client_credentials.
  code_challenge_methods_supported:
  - plain
  - S256
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - private_key_jwt
  - client_secret_basic
  id_token_signing_alg_values_supported:
  - RS256
  response_types_supported:
  - code
  scopes_supported:
  - openid
  - offline_access
  require_pushed_authorization_requests: false
  mtls_bound_tokens: false
api_key:
  schemes:
  - api_key_header (header)
  - api_key (query string)
  recommended: api_key_header
  warning: The query-string variant places a credential in access logs and proxy history; prefer the header.
  used_by: Virto's own MCP adapter authenticates with a platform API key in the api_key header.
authorization_model:
  mechanism: platform permissions, not OAuth scopes
  note: scopes_supported is openid + offline_access only. Access control is Virto's fine-grained permission
    system — colon-namespaced strings such as webhooks:read, webhooks:update, webhooks:feed:read — granted
    to roles. Permissions are NOT expressed in the OpenAPI, so a client cannot discover the permission
    an operation needs; a 403 comes back with an empty body.