generated: '2026-07-22'
method: searched
source: https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/457316022/Client+API+Service+Adoption+Using+OAuth+2.0+Protocol
docs: https://cmegroupclientsite.atlassian.net/wiki/spaces/EPICSANDBOX/pages/457316022/Client+API+Service+Adoption+Using+OAuth+2.0+Protocol
notes: >-
  CME Group secures its cloud REST and WebSocket APIs (Reference Data API v3,
  FedWatch, Term SOFR, Greeks and Implied Volatility, Cross Currency, DataMine)
  with OAuth 2.0 client-credentials issued against a registered OAuth API ID.
  API IDs are created in the CME Customer Center under My Profile and must be
  entitled per API. The authorization server is PingFederate at
  auth.cmegroup.com and publishes anonymous RFC 8414 / OIDC discovery metadata
  (captured in well-known/). Legacy Basic Auth API IDs can be irreversibly
  converted to OAuth IDs. No public OpenAPI declares these schemes — profile
  captured from the published docs and live metadata.
summary:
  types: [oauth2]
  oauth2_flows: [clientCredentials]
  token_auth_methods: [client_secret_basic, client_secret_post, client_secret_jwt, private_key_jwt, tls_client_auth]
  api_request_auth: 'Authorization: Bearer <access_token> (REST GET/POST and WebSocket upgrade)'
schemes:
  - name: CMEGroupOAuth
    type: oauth2
    flows:
      - flow: clientCredentials
        tokenUrl: https://auth.cmegroup.com/as/token.oauth2
        environment: production
      - flow: clientCredentials
        tokenUrl: https://authnr.cmegroup.com/as/token.oauth2
        environment: new-release
    token_request:
      method: POST
      content_type: application/x-www-form-urlencoded
      authorization: 'Basic base64(APIID:Password)'
      body: grant_type=client_credentials
    token_response:
      fields: [access_token, token_type, expires_in]
      token_type: bearer
      lifetime: about one hour
    authorization_server_metadata:
      issuer: https://auth.cmegroup.com
      authorization_endpoint: https://auth.cmegroup.com/as/authorization.oauth2
      token_endpoint: https://auth.cmegroup.com/as/token.oauth2
      revocation_endpoint: https://auth.cmegroup.com/as/revoke_token.oauth2
      introspection_endpoint: https://auth.cmegroup.com/as/introspect.oauth2
      jwks_uri: https://auth.cmegroup.com/pf/JWKS
      source: well-known/cme-group-oauth-authorization-server.json
    entitlements: >-
      Access is entitlement-based per API ID — each API ID must be entitled to
      the specific API (e.g. Reference Data, FedWatch, Term SOFR) via the CME
      Group Market Data API self-service onboarding page or Global Account
      Management. Credentials are environment-specific (New Release vs
      Production) and cannot be used across environments.