generated: '2026-07-23'
method: searched
source: >-
  https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/.well-known/openid-configuration
  (live Okta OIDC discovery) + developer.ntrs.com portal review
docs: https://developer.ntrs.com/get-started
summary:
  types: [oauth2, openIdConnect]
  oauth2_flows: [authorizationCode]
  pkce: required
  pkce_methods: [S256]
  identity_provider: Okta
  issuer: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8
  api_transport: Bearer access token to the enterprise gateway (https://apiservices.ntrs.com/ent/v1)
  gateway_api_key: >-
    The portal additionally carries a gateway API-key header; direct
    unauthenticated or portal-key-only calls to the gateway are rejected (401/500).
schemes:
- name: NorthernTrustOIDC
  type: openIdConnect
  openIdConnectUrl: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/.well-known/openid-configuration
  identity_provider: Okta
  issuer: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8
  authorization_endpoint: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/authorize
  token_endpoint: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/token
  userinfo_endpoint: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/userinfo
  jwks_uri: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/keys
  registration_endpoint: https://login.ntrs.com/oauth2/v1/clients
  id_token_signing_alg: [RS256]
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - client_secret_jwt
  - private_key_jwt
  - none
- name: NorthernTrustOAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/authorize
    tokenUrl: https://login.ntrs.com/oauth2/aus1m4yuzpqNFht7o0h8/v1/token
    pkce: S256
  grant_types_supported:
  - authorization_code
  - refresh_token
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
notes: >-
  Authorization Code + PKCE (S256) against an Okta-hosted custom authorization
  server. private_key_jwt client authentication is supported, which is the
  FAPI-grade confidential-client method appropriate for the institutional B2B
  audience. Business scopes (aor.role, api.read, interclient_access) are captured
  in scopes/northern-trust-scopes.yml. Live API access requires partner
  registration; only the anonymous discovery metadata is public.