generated: '2026-08-01'
method: searched
source: https://api.crexi.com/.well-known/openid-configuration
docs: https://learn.crexi.com/listing-api-overview-crexi-help-center
note: 'Derived from live discovery documents and from the published Swagger UI login
  script on the Exchange API gateway, not from an OpenAPI securitySchemes block — no
  CREXi OpenAPI document is publicly retrievable (every spec URL found is auth-gated).'
summary:
  types:
  - apiKey
  - http
  - oauth2
  - openIdConnect
  api_key_in:
  - header
  oauth2_flows:
  - password
  - refresh_token
  - switch_user
  - single_use_token_exchange
schemes:
- name: ExchangeApiKey
  type: apiKey
  in: header
  parameter_name: x-api-key
  description: Enter your api key
  api: crexi-exchange-api
  sources:
  - https://exchange.crexi.com/Content/auth.js
  evidence: 'The Swagger UI login page served at https://exchange.crexi.com/ stores
    the credential as {"ApiKey":{"name":"ApiKey","schema":{"type":"apiKey","description":"Enter
    your api key","name":"x-api-key","in":"header"}}} — a verbatim OpenAPI apiKey security
    scheme published in the page''s auth.js.'
- name: SwaggerUiBasic
  type: http
  scheme: basic
  api: crexi-platform-api
  description: The Swashbuckle Swagger UI and its spec document on the platform API
    host are protected by HTTP Basic authentication.
  sources:
  - https://api.crexi.com/swagger/v1/swagger.json
  evidence: 'HTTP/2 401 with response header `www-authenticate: Basic` observed 2026-08-01.'
- name: CrexiOAuth2
  type: oauth2
  api: crexi-platform-api
  issuer: https://api.crexi.com/
  token_endpoint: https://api.crexi.com/token
  jwks_uri: https://api.crexi.com/.well-known/jwks
  grant_types_supported:
  - password
  - switch_user
  - single_use_token_exchange
  - refresh_token
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - private_key_jwt
  - client_secret_basic
  scopes_supported:
  - openid
  - offline_access
  sources:
  - well-known/crexi-oauth-authorization-server.json
- name: CrexiOpenIDConnect
  type: openIdConnect
  api: crexi-platform-api
  openIdConnectUrl: https://api.crexi.com/.well-known/openid-configuration
  id_token_signing_alg_values_supported:
  - RS256
  subject_types_supported:
  - public
  claims_supported:
  - aud
  - exp
  - iat
  - iss
  - sub
  prompt_values_supported:
  - consent
  - login
  - none
  - select_account
  sources:
  - well-known/crexi-openid-configuration.json
- name: ListingApiToken
  type: apiKey
  api: crexi-listing-api
  in: unknown
  description: 'CREXi issues an API token to each qualifying Listing API partner during
    onboarding. The help centre documents token issuance but publishes neither the
    transport (header/query) nor the parameter name.'
  sources:
  - https://learn.crexi.com/listing-api-overview-crexi-help-center
  gated: true
observations:
- The OAuth 2.0 authorization server metadata document is byte-identical to the OpenID
  Connect discovery document.
- No authorization_endpoint is advertised — only a token endpoint — consistent with
  the advertised grant set (resource-owner password, refresh, user switching, single-use
  token exchange) rather than a redirect-based authorization code flow.
- require_pushed_authorization_requests is false; tls_client_certificate_bound_access_tokens
  is false; authorization_response_iss_parameter_supported is true.
- No mutualTLS scheme and no PKCE/authorization-code metadata are published.
x-evidence:
  fetched: '2026-08-01'
  urls:
  - url: https://api.crexi.com/.well-known/openid-configuration
    http_status: 200
  - url: https://api.crexi.com/.well-known/oauth-authorization-server
    http_status: 200
  - url: https://api.crexi.com/swagger/v1/swagger.json
    http_status: 401
  - url: https://exchange.crexi.com/Content/auth.js
    http_status: 200