/realms/{realm}/protocol/openid-connect/token
application/x-www-form-urlencoded
DEVELOPERS · CheckID · API 1.2.260123
API Authentication
OAuth2 Client Credentials, access tokens and Bearer authorization from the latest CheckID specification.
OAUTH2 CLIENT CREDENTIALS
Service-to-service authentication
Never place client_secret in browser code or the offline package.
01Client ID + SecretServer-side secret
02Basic AuthBase64(client_id:client_secret)
03Token endpoint/protocol/openid-connect/token
04grant_typeclient_credentials
05Access TokenBearer
06CheckIDWSO2 protected API
SECURITY
Sanitized examples only
<CLIENT_ID> · <CLIENT_SECRET> · <ACCESS_TOKEN>
TECHNICAL REFERENCE
Current authentication contract
OAuth2 Client Credentials → access token → Bearer authorization
Source of truth
`docs/API_SOURCE_VERSIONING.md` identifies CheckID API contract V1.2.260123 as the current source of truth and states that it supersedes legacy AWS Signature documentation.
Token endpoint
The catalog defines `POST /realms/{realm}/protocol/openid-connect/token`, `grant_type=client_credentials` and Basic client authentication according to the source.
Bearer use
Partner operations in the catalog use `Bearer
Expiry
The source example returns `expires_in=1800`; this is a contract example value, not an SLA or immutable policy for every environment.
Legacy boundary
AWS Signature is historical integration guidance from an older source. There is no current “AWS Signature ” contract in the v9 source set.
Operational security
Secret storage, rotation, mTLS/allowlisting and token revocation require separate security/environment sources; Public documentation does not add mechanisms absent from the API contract.