generated: '2026-07-19'
method: searched
source: >-
  well-known/gigya-oauth-authorization-server.json (RFC 8414 metadata, fetched
  200 from https://accounts.us1.gigya.com/.well-known/oauth-authorization-server);
  SAP Customer Data Cloud (Gigya) REST API documentation on help.sap.com.
docs: https://help.sap.com/docs/SAP_CUSTOMER_DATA_CLOUD
summary:
  types: [apiKey, oauth2]
  api_key_in: [query, body]
  oauth2_flows: [clientCredentials]
schemes:
  - name: gigya-api-key-and-secret
    type: apiKey
    description: >-
      Gigya's classic REST authentication. Every request carries the site
      `apiKey` plus a credential — an application/user key and secret used to
      HMAC-SHA1 sign the request (or a `userKey`+`secret` pair, or a session
      `oauth_token` obtained from socialize.login). Credentials are passed as
      request parameters (query string or POST body).
    evidence: SAP CDC REST API auth model documented on help.sap.com
  - name: gigya-oauth2
    type: oauth2
    flow: clientCredentials
    issuer: https://oauth2.gigya.com
    token_endpoint: https://accounts.us1.gigya.com/oauth2/token
    introspection_endpoint: https://accounts.us1.gigya.com/introspect
    revocation_endpoint: https://accounts.us1.gigya.com/revocation
    jwks_uri: https://accounts.us1.gigya.com/oauth2/jwks
    grant_types: [client_credentials, refresh_token]
    token_endpoint_auth_methods: [client_secret_post]
    evidence: well-known/gigya-oauth-authorization-server.json
notes: >-
  Host shown is the US data center (us1); the same endpoints exist per data
  center (eu1, eu2, au1, cn1, ...) under accounts.{dc}.gigya.com. The RFC 8414
  metadata advertises no `scopes_supported`, so no OAuth scope reference is
  captured (see scopes/ — skipped).