generated: '2026-09-14'
method: probed
source: https://connect.glacierbank.com/.well-known/openid-configuration
provider: Glacier Bancorp
providerId: glacier-bancorp
description: 'Authentication profile for the only machine-readable API surface Glacier Bancorp publishes:
  the OpenID Connect issuer for Glacier Bank''s Jack Henry Banno digital-banking tenant. There is no Glacier
  Bancorp developer portal, no published OpenAPI, and no self-service API program; third-party access
  is via the Banno Digital Toolkit against this tenant issuer.'
ownership: 'Served from connect.glacierbank.com, the Banno Online host of Glacier Bank — the lead bank
  subsidiary of Glacier Bancorp, Inc. Every endpoint in the document (issuer, authorization, token, userinfo,
  jwks, introspection, revocation, PAR, logout) is on that Glacier-controlled host, so the DEPLOYMENT
  is Glacier''s. The scope and claim vocabulary is Jack Henry''s (api.banno.com/..., jackhenry.com/...),
  so the CONTRACT is vendor-authored: Glacier Bancorp operates a Banno Digital Toolkit tenant, it does
  not publish an API of its own design. No Jack Henry specification has been copied into this repository.'
schemes:
- name: banno_tenant_oidc
  type: openIdConnect
  protocol: OpenID Connect 1.0
  openIdConnectUrl: https://connect.glacierbank.com/.well-known/openid-configuration
  issuer: https://connect.glacierbank.com/a/consumer/api/v0/oidc
  endpoints:
    authorization: https://connect.glacierbank.com/a/consumer/api/v0/oidc/auth
    token: https://connect.glacierbank.com/a/consumer/api/v0/oidc/token
    userinfo: https://connect.glacierbank.com/a/consumer/api/v0/oidc/me
    jwks: https://connect.glacierbank.com/a/consumer/api/v0/oidc/jwks
    introspection: https://connect.glacierbank.com/a/consumer/api/v0/oidc/token/introspection
    revocation: https://connect.glacierbank.com/a/consumer/api/v0/oidc/token/revocation
    pushed_authorization_request: https://connect.glacierbank.com/a/consumer/api/v0/oidc/request
    end_session: https://connect.glacierbank.com/a/consumer/api/v0/oidc/logout
  grant_types:
  - authorization_code
  - refresh_token
  - urn:ietf:params:oauth:grant-type:token-exchange
  response_types:
  - code
  - none
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  id_token_signing_alg_values:
  - ES256
  - PS256
  - RS256
  dpop_signing_alg_values:
  - PS256
  - PS384
  - ES256
  - ES256K
  - ES384
  - ES512
  - EdDSA
  pkce_code_challenge_methods:
  - S256
  subject_types:
  - public
  scope_count: 116
  acr_values: &id001
  - https://api.banno.com/consumer/security-level/standard
  - https://api.banno.com/consumer/security-level/enhanced
  - https://api.banno.com/consumer/security-level/high
  - https://api.banno.com/consumer/security-level/restricted
  claims_parameter_supported: true
  authorization_response_iss_parameter_supported: true
  dynamic_client_registration: false
  notes: 'No registration_endpoint is advertised: client credentials for this tenant are issued out of
    band by the institution/Jack Henry, so onboarding is not self-service.'
step_up:
  mechanism: acr_values
  levels: *id001
  note: Four Banno consumer security levels can be requested per authorization request.
mtls: false
api_keys: false
docs: https://jackhenry.dev/open-api-docs/consumer-api/
docs_note: Vendor (Jack Henry) documentation for the platform this tenant runs; not a Glacier Bancorp
  property.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com