Weave · Authentication Profile

Weave Authentication

Authentication

Weave secures its APIs with oauth2 and openIdConnect across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, implicit, and refreshToken flow(s).

CompanyCommunicationMessagingPaymentsHealthcareVoIPTelephonyReviewsSchedulingSMBDeveloper PlatformOAuth
Methods: oauth2, openIdConnect Schemes: 1 OAuth flows: authorizationCode, clientCredentials, implicit, refreshToken API key in:

Security Schemes

WeaveOIDC openIdConnect

Source

Authentication Profile

weave-authentication.yml Raw ↑ 
generated: '2026-07-21'
method: searched
source: https://oidc.weaveconnect.com/.well-known/openid-configuration
docs: https://dp.getweave.com/docs
summary:
  types:
  - oauth2
  - openIdConnect
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - implicit
  - refreshToken
  pkce: S256
schemes:
- name: WeaveOIDC
  type: openIdConnect
  openIdConnectUrl: https://oidc.weaveconnect.com/.well-known/openid-configuration
  issuer: https://oidc.weaveconnect.com
  authorization_endpoint: https://oidc.weaveconnect.com/oauth2/auth
  token_endpoint: https://oidc.weaveconnect.com/oauth2/token
  userinfo_endpoint: https://oidc.weaveconnect.com/userinfo
  jwks_uri: https://oidc.weaveconnect.com/.well-known/jwks.json
  revocation_endpoint: https://oidc.weaveconnect.com/oauth2/revoke
  end_session_endpoint: https://oidc.weaveconnect.com/oauth2/sessions/logout
  grant_types:
  - authorization_code
  - implicit
  - client_credentials
  - refresh_token
  token_endpoint_auth_methods:
  - client_secret_post
  - client_secret_basic
  - private_key_jwt
  - none
  code_challenge_methods:
  - S256
  - plain
  id_token_signing_alg:
  - RS256
  sources:
  - well-known/weave-openid-configuration.json
notes: >-
  Weave's developer platform authorizes API calls to api.weaveconnect.com with
  OAuth 2.0 / OpenID Connect bearer tokens issued by an Ory Hydra authorization
  server at oidc.weaveconnect.com. Partner apps use the authorization_code flow
  (with PKCE S256) for user-context access and client_credentials for
  service-to-service access. No public OpenAPI is published, so this profile is
  derived from the live OIDC discovery document rather than spec securitySchemes.