World Fuel Services Authentication

generated: '2026-08-29'
method: probed
source: https://auth.wfscorp.com/.well-known/openid-configuration
note: >-
  World Kinect publishes no public developer program and no OpenAPI, so there are no
  securitySchemes to derive from. What it DOES publish anonymously is a full OpenID Connect
  Discovery document on auth.wfscorp.com — the Auth0-backed identity host that the myWorld
  customer portal (myworld.wfscorp.com) authenticates against. Everything below is read
  verbatim from that document; nothing is inferred. Access to the APIs the portal calls is
  still gated: the tenant issues tokens only to registered clients, and a customer requests
  portal access through a sales form rather than self-service signup.
domain_ownership: >-
  wfscorp.com is World Kinect Corporation's own legacy corporate domain — it 301s to
  www.world-kinect.com and the myWorld portal SPA served from myworld.wfscorp.com names
  auth.wfscorp.com as its issuer in its published JavaScript bundle.
schemes:
- id: openid-connect
  type: openIdConnect
  openIdConnectUrl: https://auth.wfscorp.com/.well-known/openid-configuration
  issuer: https://auth.wfscorp.com/
  platform: Auth0 (custom domain)
  endpoints:
    authorization: https://auth.wfscorp.com/authorize
    token: https://auth.wfscorp.com/oauth/token
    userinfo: https://auth.wfscorp.com/userinfo
    jwks: https://auth.wfscorp.com/.well-known/jwks.json
    revocation: https://auth.wfscorp.com/oauth/revoke
    device_authorization: https://auth.wfscorp.com/oauth/device/code
    backchannel_authentication: https://auth.wfscorp.com/bc-authorize
    dynamic_registration: https://auth.wfscorp.com/oidc/register
    mfa_challenge: https://auth.wfscorp.com/mfa/challenge
  grant_types:
  - authorization_code
  - client_credentials
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  response_types:
  - code
  - token
  - id_token
  - code token
  - code id_token
  - token id_token
  - code token id_token
  pkce:
    supported: true
    code_challenge_methods:
    - S256
    - plain
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  id_token_signing_algs:
  - HS256
  - RS256
  - PS256
  dpop_signing_algs:
  - ES256
  mfa:
    supported: true
    evidence: mfa_challenge_endpoint and the mfa-oob / mfa-otp / mfa-recovery-code grant types.
  logout:
    backchannel_logout_supported: true
    backchannel_logout_session_supported: true
  observations:
  - The `implicit` and `password` (ROPC) grants are still advertised alongside
    authorization_code + PKCE; both are discouraged by OAuth 2.1.
  - '`plain` remains in code_challenge_methods_supported next to S256.'
  - HS256 is advertised for id_token signing alongside RS256/PS256.
  - No custom API scopes appear in scopes_supported — only the OIDC/profile set.
onboarding:
  self_service: false
  path: https://www.world-kinect.com/about-us/contact-us/portal-access-form
  note: >-
    Portal access is requested through a form; there is no public API key issuance, no
    documented client-credentials onboarding, and no published developer terms.