Wideorbit Authentication

generated: '2026-07-21'
method: searched
source: >-
  WO Central Keycloak OIDC discovery document
  (https://sso.wocentral.com/auth/realms/externalgateway/.well-known/openid-configuration)
  observed live redirect from https://apigateway.wideorbit.com
docs: https://www.wideorbit.com/io/
summary: >-
  The WideOrbit.io partner API gateway is protected by OpenID Connect on a
  Keycloak identity provider hosted at WO Central. Every unauthenticated request
  to apigateway.wideorbit.com is redirected to the "externalgateway" realm
  authorization endpoint (client_id=apigateway, scope=openid, response_type=code),
  confirming the OAuth 2.0 authorization-code flow. The realm also advertises
  client_credentials for machine-to-machine partner integrations.
schemes:
- id: oidc_externalgateway
  type: openIdConnect
  provider: Keycloak (WO Central)
  realm: externalgateway
  openIdConnectUrl: https://sso.wocentral.com/auth/realms/externalgateway/.well-known/openid-configuration
  issuer: https://sso.wocentral.com/auth/realms/externalgateway
  endpoints:
    authorization: https://sso.wocentral.com/auth/realms/externalgateway/protocol/openid-connect/auth
    token: https://sso.wocentral.com/auth/realms/externalgateway/protocol/openid-connect/token
    jwks: https://sso.wocentral.com/auth/realms/externalgateway/protocol/openid-connect/certs
  grant_types:
  - authorization_code
  - client_credentials
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  token_endpoint_auth_methods:
  - private_key_jwt
  - client_secret_basic
  - client_secret_post
  - tls_client_auth
  - client_secret_jwt
  observed_gateway_client: apigateway
  observed_default_scope: openid
  environments:
    production: https://sso.wocentral.com/auth/realms/externalgateway
    pre-production: https://ppe-sso.wocentral.com/auth/realms/externalgateway
notes: >-
  Access is limited to WideOrbit-certified partners; credentials are provisioned
  through the WideOrbit.io program rather than self-service registration. No
  API-key or HTTP-basic scheme was observed on the gateway.