generated: '2026-08-26'
method: probed
source: >-
  https://auth.point.me/.well-known/openid-configuration (HTTP 200, fetched 2026-08-26)
  for the identity layer, and the live response headers of https://api.point.me/
  (HTTP 401, WWW-Authenticate: Bearer) for the API layer. point.me publishes no
  developer authentication page; everything here is read off surfaces it actually serves.
description: >-
  How a caller authenticates to point.me. Identity is an Auth0 tenant at
  auth.point.me exposing a complete OIDC discovery document; the API host
  api.point.me is a bearer-token resource server that refuses every anonymous
  request. No public API credential issuance exists — access to api.point.me is
  arranged through the Gateway partnership sales process.
api: point-me-flight-search-api
base_url: https://api.point.me

security_schemes:
  - name: bearerAuth
    type: http
    scheme: bearer
    bearer_format: JWT
    in: header
    header: Authorization
    evidence: >-
      https://api.point.me/ and every other probed path return
      `www-authenticate: Bearer`. The token issuer is the auth.point.me Auth0
      tenant, whose id_token signing algs are HS256/RS256/PS256.
    method: probed
  - name: oidc
    type: openIdConnect
    openid_connect_url: https://auth.point.me/.well-known/openid-configuration
    issuer: https://auth.point.me/
    authorization_endpoint: https://auth.point.me/authorize
    token_endpoint: https://auth.point.me/oauth/token
    userinfo_endpoint: https://auth.point.me/userinfo
    jwks_uri: https://auth.point.me/.well-known/jwks.json
    registration_endpoint: https://auth.point.me/oidc/register
    revocation_endpoint: https://auth.point.me/oauth/revoke
    end_session_endpoint: https://auth.point.me/oidc/logout
    device_authorization_endpoint: https://auth.point.me/oauth/device/code
    method: probed

oauth2:
  provider: Auth0
  grant_types:
    - authorization_code
    - client_credentials
    - refresh_token
    - password
    - implicit
    - urn:ietf:params:oauth:grant-type:device_code
    - urn:ietf:params:oauth:grant-type:token-exchange
    - urn:ietf:params:oauth:grant-type:jwt-bearer
    - http://auth0.com/oauth/grant-type/password-realm
    - http://auth0.com/oauth/grant-type/passwordless/otp
    - http://auth0.com/oauth/grant-type/mfa-oob
    - http://auth0.com/oauth/grant-type/mfa-otp
    - http://auth0.com/oauth/grant-type/mfa-recovery-code
  response_types: [code, token, id_token, code token, code id_token, token id_token, code token id_token]
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, private_key_jwt, none]
  pkce:
    supported: true
    code_challenge_methods: [S256, plain]
  id_token_signing_algs: [HS256, RS256, PS256]
  dynamic_client_registration: true
  mfa:
    supported: true
    evidence: >-
      mfa_challenge_endpoint https://auth.point.me/mfa/challenge plus the
      mfa-oob / mfa-otp / mfa-recovery-code grant types in the discovery document.
  notes: >-
    These are the capabilities the Auth0 tenant advertises, not necessarily the
    subset point.me enables for any given client. `client_credentials` being
    present is the machine-to-machine path a Gateway partner would most likely use.

sso:
  supported: true
  evidence: >-
    "SSO integration" is listed under Enterprise-Grade Security on
    https://www.point.me/partnerships/financial-institutions/ — a Gateway
    partner capability, not a self-service one.

credential_issuance:
  self_service: false
  detail: >-
    There is no developer signup, key page, or console for api.point.me. The only
    published route to credentials is the "Book a demo" HubSpot form on the Gateway
    partnership pages.
  docs: https://www.point.me/partnerships/

x-evidence:
  checked: '2026-08-26'
  probes:
    - url: https://auth.point.me/.well-known/openid-configuration
      status: 200
    - url: https://auth.point.me/.well-known/jwks.json
      status: 200
    - url: https://api.point.me/
      status: 200
      note: 'body "Flight Search APIs"; every deeper path answers 401 Bearer'
    - url: https://api.point.me/docs
      status: 401