generated: '2026-08-02'
method: searched
source: openapi/afero-authentication-api-openapi.yml, openapi/afero-devices-api-openapi.yml,
  openapi/afero-ota-api-openapi.yml, openapi/afero-users-api-openapi.yml
docs: https://afero-docs.readthedocs.io/en/latest/API-OAuthEndpoints/
summary:
  types:
  - http
  - oauth2
  oauth2_flows:
  - password
  token_endpoint: https://api.afero.io/oauth/token
  client_authentication: http-basic
  token_transport: 'Authorization: Bearer <access_token>'
  token_lifetime: Approximately four hours; exact value returned in expires_in (seconds).
  refresh_token: Not documented — re-run the password grant when the token expires.
  scopes_documented: false
  standards:
  - RFC 6749 (cited directly by Afero in the OTA API prerequisites)
  - RFC 6750 bearer token usage
schemes:
- name: basicAuth
  type: http
  scheme: basic
  used_on:
  - POST /oauth/token
  description: 'HTTP Basic client authentication on the token endpoint. The header value is the
    string `Basic ` followed by the Base64 encoding of `<OAuth Client ID>:<OAuth Client Secret>`.
    Both credentials are issued to a partner and viewed in the Afero Profile Editor under
    VIEW > ACCOUNT INFO. Afero warns that developer credentials obtained through the Profile
    Editor must not be used in production applications.'
  sources:
  - openapi/afero-authentication-api-openapi.yml
- name: bearerAuth
  type: http
  scheme: bearer
  used_on:
  - Every /v1/ operation (users, devices, OTA)
  description: 'The OAuth 2.0 access token returned by POST /oauth/token, sent as
    `Authorization: Bearer <access_token>`. The token is issued for an end-user and is used to
    authenticate requests on that user''s behalf. It expires — the docs state approximately four
    hours and the response carries expires_in in seconds. An expired or missing token returns
    HTTP 401 with error `unauthorized`.'
  sources:
  - openapi/afero-devices-api-openapi.yml
  - openapi/afero-ota-api-openapi.yml
  - openapi/afero-users-api-openapi.yml
flow:
  grant_type: password
  request:
    method: POST
    url: https://api.afero.io/oauth/token
    headers:
      Content-Type: application/x-www-form-urlencoded
      Accept: application/json
      Authorization: Basic <base64(clientId:clientSecret)>
    body_fields:
    - username (the Afero account email address)
    - password
    - grant_type=password
  response_fields:
  - access_token
  - token_type (bearer)
  - expires_in (seconds)
  - scope
  observed_scope_value: partner account
authorization_model:
  note: 'Afero has no OAuth scope reference page and does not document scope-based authorization.
    Authorization is enforced through account and partner PRIVILEGE objects returned by
    GET /v1/users/me rather than through token scopes.'
  account_privileges:
  - canWrite
  - owner
  partner_privileges:
  - inviteUsers
  - manageDeviceProfiles
  - owner
  - viewDeviceInfo
  source: https://afero-docs.readthedocs.io/en/latest/API-UserEndpoints/
discovery:
  openid_configuration: 404 at https://api.afero.io/.well-known/openid-configuration
  oauth_authorization_server: 404 at https://api.afero.io/.well-known/oauth-authorization-server
  note: Afero publishes no OAuth or OIDC discovery metadata; the token endpoint is documented in
    prose only.
gaps:
- No authorization_code or client_credentials flow — only the RFC 6749 resource owner password
  credentials grant, which requires the partner application to handle end-user passwords directly.
- No documented refresh token.
- No OAuth scopes are published, so scopes/ is not emitted for this provider.
- No PKCE, no token revocation and no token introspection endpoint documented.