generated: '2026-08-11'
method: searched
docs: https://attestazione.spaziogenesi.org/en/developer/keys/
keys_signup: https://attestazione.spaziogenesi.org/en/developer/keys/
source: openapi/imgauth-api-di-attestazione-opere-digitali-openapi-original.json
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
schemes:
- name: agentBearer
  type: http
  scheme: bearer
  bearerFormat: sg_k_<id>_<secret> oppure sg_s_<id>_<secret>
  description: 'Credenziale agente (P21): API key per convenzioni o session token da device
    flow. Sblocca SOLO il bypass della challenge Turnstile su POST /api/hash — HMAC, timestamp
    server e rate limit per-IP restano invariati. Facoltativa: senza header, il percorso Turnstile
    è identico a prima.'
  sources:
  - openapi/imgauth-api-di-attestazione-opere-digitali-openapi-original.json
- name: voucherHeader
  type: apiKey
  in: header
  parameter: X-SG-Voucher
  description: 'Voucher firmato stateless (P25 §2.7): ottenuto SOLO tramite il flusso OAuth
    "Attesta con la tua email" sul sito — non c''è un endpoint pubblico in questo contratto
    che lo emette. TTL 8h. Bypassa il solo Turnstile su /api/hash e /api/cert-pdf, applica pool/tetto
    di un''eventuale convenzione o la fascia Professionale — stesso principio del bearer agente.'
  sources:
  - openapi/imgauth-api-di-attestazione-opere-digitali-openapi-original.json
optional_by_design: true
note: >-
  Authentication is OPTIONAL on every operation in this contract, and that is deliberate rather than an
  omission. A credential does not unlock data or endpoints — it bypasses the Turnstile anti-bot challenge
  on POST /api/hash and POST /api/cert-pdf and applies the tier quota. HMAC verification, the server
  timestamp and the per-IP rate limits are identical with or without one. All verification and telemetry
  operations are fully anonymous.
oauth2: false
openid_connect: false
oauth_discovery:
  well_known_openid_configuration: 404
  well_known_oauth_authorization_server: 404
  well_known_oauth_protected_resource: 404
  note: >-
    No OAuth 2.0 on the API itself. Social OAuth (Google, Microsoft, LinkedIn) is used only on the website
    to verify a human's email before issuing a developer key — it is not an API authorization flow, and no
    RFC 8414 or OIDC discovery document is served on any host.
credentials:
  - kind: api_key
    prefix: sg_k_
    issuance: self-service at https://attestazione.spaziogenesi.org/en/developer/keys/ after email verification
    transport: 'Authorization: Bearer sg_k_<id>_<secret>'
    env_var: IMGAUTH_API_KEY
    expiry: not published
    rotation: not published
    revocation: 'by the provider on abuse; user may request deletion of associated data'
  - kind: session_token
    prefix: sg_s_
    issuance: device flow — POST /api/agent/authorize, human approval, GET /api/agent/token
    lifetime: 24h / 20 attestations
    note: delivered EXACTLY ONCE; subsequent polls return status 'claimed'
  - kind: voucher
    header: X-SG-Voucher
    ttl: 8h
    issuance: >-
      obtained ONLY through the "attest with your email" OAuth flow on the website — no endpoint in this
      contract issues one
device_flow:
  supported: true
  rfc8628_compliant: false
  note: >-
    Shaped like RFC 8628 (code, verification_url, expires_in, interval, polling, one-time token delivery)
    but served on bespoke paths under /api/agent/ rather than an RFC 8628 token endpoint, and with a
    Turnstile challenge at the human approval step. Functionally equivalent for an agent; not standards-conformant.
scopes:
  supported: false
  note: no scope or permission model — a credential is all-or-nothing against the tier quota