Yoti Authentication

generated: '2026-10-14'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://developers.yoti.com/digital-id/did-match-authentication.md
sources:
- https://developers.yoti.com/digital-id/did-match-authentication.md
- https://developers.yoti.com/age-estimation/api-authentication.md
- https://developers.yoti.com/proof-of-age/api-authentication.md
- https://developers.yoti.com/age-verification/age-token.md
description: Yoti uses OAuth2 client‑credentials flow with a JWT client assertion and also supports RSA‑signed request headers for certain APIs.
schemes:
- type: oauth2
  name: OAuth2 Client Credentials
  evidence: All API calls will be made using an OAuth Access Token as a bearer token.
  token_url: https://auth.api.yoti.com/v1/oauth/token
  scopes:
  - did:match
  - poa:verify
  how_to_obtain: Generate a JWT signed with the service/SDK private PEM key (PS384 algorithm) and use it as a client assertion in a POST request
    to the token URL to obtain an access token. The JWT must contain the required claims (iss, sub, aud, jti, exp, iat).
- type: other
  name: RSA‑signed request headers
  evidence: Yoti API endpoints are authenticated through signed requests, and the current approach for building signed requests consists of passing
    the following HTTP Headers
  location: header
  header: X-Yoti-Auth-Digest
  how_to_obtain: Compute the digest by concatenating HTTP method, path, query string (including nonce and timestamp) and base64‑encoded body with
    '&', sign the string with SHA256withRSA using the PEM private key, then Base64‑encode the signature. Include the result in the X‑Yoti‑Auth‑Digest
    header and the SDK ID in X‑Yoti‑Auth‑Id.
docs: https://developers.yoti.com/digital-id/did-match-authentication.md