generated: '2026-08-04'
method: searched
source: https://auth.movableink.com/.well-known/openid-configuration
docs: https://www.braze.com/docs/partners/message_personalization/dynamic_content/visual_and_interactive_content/movable_ink/customer_data_api
name: Movable Ink Authentication Profile
description: >-
  Movable Ink runs two distinct authentication models. Machine-to-machine data
  ingestion into the Customer Data API uses HTTP Basic authentication with an
  Access Key ID and Access Secret issued per integration by the Movable Ink
  Solutions / Client Experience team, scoped to a per-tenant endpoint key
  embedded in the path. Human access to the Movable Ink Studio application uses
  OpenID Connect against an Auth0 tenant at auth.movableink.com. There is no
  self-service API key issuance and no public developer credential flow.
schemes:
  - id: customer_data_api_basic
    type: http
    scheme: basic
    surface: Customer Data API
    in: header
    header: Authorization
    value_format: 'Basic base64(access_key_id:access_secret)'
    endpoint_pattern: https://collector.movableink-dmz.com/behavioral/{endpoint_key}
    credential_issuance: >-
      Not self-service. The Movable Ink Solutions Architect / Client Experience
      team issues the endpoint URL (with the tenant key in the path), the Access
      Key ID and the Access Secret after an event-mapping conversation. Movable
      Ink will supply the pair pre-base64-encoded on request.
    rotation: not documented publicly
    evidence:
      - https://www.braze.com/docs/partners/message_personalization/dynamic_content/visual_and_interactive_content/movable_ink/customer_data_api
      - https://docs.tealium.com/server-side-connectors/movable-ink-connector/
      - https://segment.com/docs/connections/destinations/catalog/actions-movable-ink/
  - id: studio_oidc
    type: openIdConnect
    surface: Movable Ink Studio web application (app.movableink.com)
    openIdConnectUrl: https://auth.movableink.com/.well-known/openid-configuration
    issuer: https://auth.movableink.com/
    provider: Auth0
    authorization_endpoint: https://auth.movableink.com/authorize
    token_endpoint: https://auth.movableink.com/oauth/token
    userinfo_endpoint: https://auth.movableink.com/userinfo
    jwks_uri: https://auth.movableink.com/.well-known/jwks.json
    revocation_endpoint: https://auth.movableink.com/oauth/revoke
    device_authorization_endpoint: https://auth.movableink.com/oauth/device/code
    registration_endpoint: https://auth.movableink.com/oidc/register
    mfa_challenge_endpoint: https://auth.movableink.com/mfa/challenge
    grant_types:
      - authorization_code
      - refresh_token
      - client_credentials
      - implicit
      - password
      - urn:ietf:params:oauth:grant-type:device_code
      - urn:ietf:params:oauth:grant-type:token-exchange
      - urn:ietf:params:oauth:grant-type:jwt-bearer
    pkce: [S256, plain]
    token_endpoint_auth_methods:
      - client_secret_basic
      - client_secret_post
      - private_key_jwt
      - none
    observed_app_flow: >-
      app.movableink.com 302s unauthenticated requests to
      auth.movableink.com/authorize with response_type=code and
      scope=openid profile email offline_access.
    evidence:
      - https://auth.movableink.com/.well-known/openid-configuration
      - https://app.movableink.com/
observations:
  - The Customer Data API endpoint key lives in the URL path, so the endpoint URL
    is itself a secret and must be handled as one alongside the Basic credential.
  - Basic authentication over TLS is the only documented server-to-server scheme;
    there is no bearer token, HMAC request signing, or mTLS option published.
  - The OIDC tenant advertises the full Auth0 default grant set, including the
    resource-owner password grant, which is broader than the authorization-code
    flow the Studio app actually uses.
  - No public developer signup issues API credentials; every credential path runs
    through a Movable Ink team member.
gaps:
  - No public authentication reference on a Movable Ink-owned domain. The
    authoritative guides live on support.movableink.com, which is customer-gated.
  - No documented credential rotation or revocation procedure for Customer Data
    API keys.
x-evidence:
  fetched: '2026-08-04'
  probes:
    - url: https://auth.movableink.com/.well-known/openid-configuration
      status: 200
    - url: https://app.movableink.com/
      status: 302
    - url: https://collector.movableink-dmz.com/behavioral/testkey
      status: 404