generated: '2026-08-13'
method: searched
source: openapi/ (70 documents) + https://developer.adobe.com/developer-console/docs/guides/authentication/
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - cookie
  - header
  - query
schemes:
- name: api_key
  type: apiKey
  in: header
  parameter: api_key
  sources:
  - openapi/adobe-suite-commerce-rest-customer-openapi.yaml
  - openapi/adobe-suite-commerce-rest-guest-openapi.yaml
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: x-api-key
  description: API Access Key
  sources:
  - openapi/adobe-suite-data-collection-openapi.yaml
  - openapi/adobe-suite-firefly-audio-video-openapi.json
  - openapi/adobe-suite-firefly-illustrator-openapi.json
  - openapi/adobe-suite-firefly-indesign-openapi.json
  - openapi/adobe-suite-firefly-lightroom-openapi.json
  - openapi/adobe-suite-firefly-openapi.json
  - openapi/adobe-suite-firefly-substance-3d-openapi.yaml
  - openapi/adobe-suite-firefly-translate-lipsync-openapi.json
  - openapi/adobe-suite-journey-optimizer-campaigns-retrieve-openapi.yaml
  - openapi/adobe-suite-vip-marketplace-partners-openapi.json
- name: IMSAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: Should be a valid IMS token for authenticating with the Edge Gateway
  sources:
  - openapi/adobe-suite-data-collection-openapi.yaml
  - openapi/adobe-suite-firefly-audio-video-openapi.json
  - openapi/adobe-suite-firefly-express-openapi.json
  - openapi/adobe-suite-firefly-illustrator-openapi.json
  - openapi/adobe-suite-firefly-indesign-openapi.json
  - openapi/adobe-suite-firefly-lightroom-openapi.json
  - openapi/adobe-suite-firefly-openapi.json
  - openapi/adobe-suite-firefly-substance-3d-openapi.yaml
  - openapi/adobe-suite-firefly-translate-lipsync-openapi.json
  - openapi/adobe-suite-firefly-workflow-builder-openapi.yaml
  - openapi/adobe-suite-journey-optimizer-content-openapi.yaml
  - openapi/adobe-suite-journey-optimizer-journey-retrieve-openapi.yaml
  - openapi/adobe-suite-journey-optimizer-messaging-openapi.yaml
  - openapi/adobe-suite-journey-optimizer-orchestrated-campaign-dataset-openapi.yaml
  - openapi/adobe-suite-journey-optimizer-simulations-openapi.yaml
  - openapi/adobe-suite-journey-optimizer-suppression-openapi.yaml
  - openapi/adobe-suite-status-openapi.yaml
  - openapi/adobe-suite-workfront-unified-approvals-openapi.json
- name: apiKey
  type: apiKey
  in: header
  parameter: X-API-KEY
  sources:
  - openapi/adobe-suite-firefly-express-openapi.json
- name: Authorization
  type: http
  scheme: Bearer
  description: User access token (Bearer xxx)
  sources:
  - openapi/adobe-suite-firefly-photoshop-v2-openapi.json
- name: X-Api-Key
  type: apiKey
  in: header
  parameter: X-Api-Key
  description: Api key (adobe.io)
  sources:
  - openapi/adobe-suite-firefly-photoshop-v2-openapi.json
- name: api_key
  type: apiKey
  in: query
  parameter: api_key
  description: Use the api key `StatusAdobeIOClient`
  sources:
  - openapi/adobe-suite-status-openapi.yaml
- name: authorization
  type: apiKey
  in: header
  parameter: authorization
  sources:
  - openapi/adobe-suite-vip-marketplace-partners-openapi.json
- name: SessionIDHeader
  type: apiKey
  in: header
  parameter: sessionID
  sources:
  - openapi/adobe-suite-workfront-workflow-openapi.json
- name: AtTaskCookie
  type: apiKey
  in: cookie
  parameter: attask
  sources:
  - openapi/adobe-suite-workfront-workflow-openapi.json
- name: WFAuthCookie
  type: apiKey
  in: cookie
  parameter: wf-auth
  sources:
  - openapi/adobe-suite-workfront-workflow-openapi.json
- name: ApiKeyHeader
  type: apiKey
  in: header
  parameter: apiKey
  sources:
  - openapi/adobe-suite-workfront-workflow-openapi.json
docs: https://developer.adobe.com/developer-console/docs/guides/authentication/
note: 'Derived mechanically from all 70 harvested OpenAPI documents, then upgraded from Adobe''s own authentication
  documentation. IMPORTANT: the specs under-report reality. Every Adobe spec models auth as an apiKey header plus
  an HTTP bearer token, but the bearer token is in fact an Adobe IMS OAuth 2.0 access token minted at https://ims-na1.adobelogin.com/ims/token/v3
  with an explicit scope list. No spec declares an oauth2 securityScheme, so an agent reading the contract alone
  cannot discover the authorization server, the grant, the scopes or the 24-hour token lifetime. See scopes/adobe-suite-scopes.yml
  and well-known/adobe-suite-openid-configuration.json.'
credential_types:
- name: OAuth Server-to-Server
  grant: client_credentials
  status: current
  docs: https://developer.adobe.com/developer-console/docs/guides/authentication/ServerToServerAuthentication/
  note: Replaced the deprecated JWT (Service Account) credential, retired 2025-06-30.
- name: OAuth Web App
  grant: authorization_code
  status: current
- name: OAuth Single Page App
  grant: authorization_code + PKCE
  status: current
- name: OAuth Native App
  grant: authorization_code + PKCE
  status: current
- name: API Key credential
  grant: none (client-side key only)
  status: current
  note: Used by client-side surfaces such as the Adobe Express Embed SDK and PDF Embed API.
- name: JWT / Service Account
  grant: urn:ietf:params:oauth:grant-type:jwt-bearer
  status: deprecated
  retired: '2025-06-30'
  docs: https://developer.adobe.com/developer-console/docs/guides/authentication/JWT/
transport_headers:
- header: Authorization
  value: Bearer <IMS access token>
  required: true
  occurrences_in_specs: 1494
- header: x-api-key
  value: <Client ID from Adobe Developer Console>
  required: true
  occurrences_in_specs: 2326
- header: x-gw-ims-org-id
  value: <IMS Org ID>
  required: per-service
  occurrences_in_specs: 1660
  note: Required by every Experience Cloud API (Experience Platform, Journey Optimizer, Marketo MCP). This is the
    tenancy selector.
token:
  lifetime: 24 hours
  refresh: re-issue via client_credentials; refresh_token supported on user flows
  endpoint: https://ims-na1.adobelogin.com/ims/token/v3