generated: '2026-08-04'
method: searched
source: https://docs.letsgetchecked.com/documentation/API%20Reference/Getting%20Started/authentication-flow/
docs: https://docs.letsgetchecked.com/documentation/API%20Reference/Getting%20Started/authentication-flow/

# Derived from the published authentication documentation, not from an OpenAPI
# securityScheme block — LetsGetChecked publishes no machine-readable specification.

summary:
  types:
  - oauth2
  - http
  oauth2_flows:
  - clientCredentials
  bearer_format: JWT
  api_key_in: []
  scopes_used: false
  mutual_tls: false
  openid_connect: false
  credential_issuance: manual
  self_service_signup: false

schemes:
- name: OAuth2ClientCredentials
  type: oauth2
  flow: clientCredentials
  token_endpoint: '{LGC-API}/oauth2/token'
  token_endpoint_note: 'The host is templated as {LGC-API} throughout the documentation.
    LetsGetChecked does not publish the production or staging API hostname; it is
    supplied privately per client during onboarding.'
  grant_type: client_credentials
  credential_model: access key ID + secret access key
  credential_format: alphanumeric, 25 characters each
  credential_transport: HTTP Basic (curl --user <access key>:<secret key>)
  request_content_type: application/x-www-form-urlencoded
  scopes: []
  scopes_note: 'No scopes are used. The 14 September 2023 release notes record "Remove
    scope from example to request an access token", so the scope parameter was
    explicitly withdrawn from the flow. There is no permissions or scopes reference
    page, which is why this repo carries no scopes/ artifact.'
  sources:
  - https://docs.letsgetchecked.com/documentation/API%20Reference/Getting%20Started/authentication-flow/

- name: BearerToken
  type: http
  scheme: bearer
  bearer_format: JWT
  in: header
  parameter_name: Authorization
  description: 'The access token returned by the token endpoint is presented as a bearer
    token on every API operation. The documented sample sends the raw token value in
    the Authorization header. Expired or invalid tokens return HTTP 401.'
  token_lifetime: 'Returned alongside the token as a validity value; no fixed TTL is
    published.'
  sources:
  - https://docs.letsgetchecked.com/documentation/API%20Reference/Getting%20Started/authentication-flow/

- name: WebhookHMACSignature
  type: http
  scheme: LGC2-HMAC-SHA256
  direction: inbound-to-client
  in: header
  parameter_name: Authorization
  algorithm: HMAC-SHA256
  encoding: base64
  signed_content: the stringified JSON request body
  key_supply: 'The client generates a strong signing key in base64 and supplies it to
    LetsGetChecked during onboarding.'
  optional: true
  optional_note: 'Signing is opt-in. The documentation states that authentication
    mechanisms are not required for submitted payloads "due to their lightweight
    content", and instructs clients to inspect the callback URL to avoid leaking
    access tokens. Signature verification is only applied when the client requests it.'
  reference: https://www.rfc-editor.org/rfc/rfc2104
  sources:
  - https://docs.letsgetchecked.com/documentation/API%20Reference/API%20Notifications/security/

environments:
- name: staging
  access: 'Credentials issued by LetsGetChecked. The staging server is IP-restricted;
    LetsGetChecked shares the staging server IP address with the client.'
- name: production
  access: 'Production credentials are issued only after LetsGetChecked has verified the
    client integration against staging.'

gaps:
- No self-service credential issuance or developer sign-up for the B2B API.
- No published API hostname for either environment.
- No OAuth scopes, so authorization is all-or-nothing per client credential.
- No token revocation, rotation, or introspection endpoint documented.
- No .well-known/oauth-authorization-server or openid-configuration on any
  LetsGetChecked host (see well-known/letsgetchecked-well-known.yml).