generated: '2026-07-18'
method: searched
source: https://help.api.cynet.com/docs/cynet/b6b6c2d4906e9-authentication
docs: https://help.api.cynet.com/docs/cynet/b6b6c2d4906e9-authentication
summary:
  types:
  - apiKey
  api_key_in:
  - header
  oauth2_flows: []
  model: token-exchange
  description: >-
    Cynet APIs use a short-lived access token. An API user (with the Cynet API User
    permission, or a role with "API - full access") authenticates against the tenant's
    Cynet API engine to receive a bearer access token that is then presented as a
    header on every subsequent request. The token is valid for 60 minutes.
schemes:
- name: cynetAccessToken
  type: apiKey
  in: header
  scheme: token
  description: >-
    Bearer access token obtained from the account token endpoint. Presented as a
    header key/value pair on every API call. Valid for 60 minutes, then re-request.
  token_endpoint: /api/account/token
  token_method: POST
  token_ttl_seconds: 3600
  credentials:
    - Access Key (API user)
    - Secret Key (API user, shown only once at creation)
    - Client ID / Site ID
  sources:
  - docs:help.api.cynet.com
base_url_pattern: https://{tenant}.api.cynet.com
versions:
- id: v1-on-prem
  label: On-Prem V1
  docs: https://help.api.cynet.com/docs/cynet/iah0dsbmetd0e-welcome-to-cynet-api-reference
- id: v3-saas
  label: SaaS V3
  docs: https://help.api.cynet.com/docs/API-V3/9g00cv3m8b10g-cynet-api-documentation
notes: >-
  No OpenID Connect or OAuth 2.0 flow is documented; auth is a custom credential
  exchange (access key + secret key -> short-lived access token). No public OpenAPI
  spec is published, so this profile is derived from the Cynet API reference docs.