generated: '2026-07-25'
method: searched
source: openapi/swisscom-sign-integration-api-openapi.json
docs: https://sign.swisscom.ch/docs/guide/authentication
portal_docs: https://digital.swisscom.com/resources/use-your-api-keys/oaut-introduction
legacy_docs: https://github.com/swisscom-api/doc/wiki/oauth-overview.html
summary:
  types:
  - oauth2
  oauth2_flows:
  - clientCredentials
schemes:
- name: SwisscomSignOAuth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://sign.swisscom.ch/realms/swisscom-public/protocol/openid-connect/token
    scopes: 3
  description: OAuth 2.0 Client Credentials flow for accessing the Swisscom Sign Integration
    API.
  sources:
  - openapi/swisscom-sign-integration-api-openapi.json
oidc:
  discovery: https://sign.swisscom.ch/realms/swisscom-public/.well-known/openid-configuration
  harvested: well-known/swisscom-sign-openid-configuration.json
  issuer: https://sign.swisscom.ch/realms/swisscom-public
  jwks_uri: https://sign.swisscom.ch/realms/swisscom-public/protocol/openid-connect/certs
  provider: Keycloak (realm swisscom-public)
  audience: swisscom-sign-api
  tenancy_claim: organization_id
example_token_request: |
  curl --request POST \
    --url https://sign.swisscom.ch/realms/swisscom-public/protocol/openid-connect/token \
    --header 'content-type: application/x-www-form-urlencoded' \
    --data 'grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_CLIENT_SECRET'
guidance: >-
  Swisscom recommends calling Swisscom Sign from your own backend so client credentials stay
  server-side. Its browser-based API explorer accepts client_id and client_secret client-side and is
  documented as a controlled-testing tool only, not a production integration pattern.
other_surfaces:
- surface: swisscom-all-in-signing-service
  spec: openapi/swisscom-all-in-signing-service-openapi.yml
  types: [mutualTLS]
  detail: >-
    The published OpenAPI declares no securitySchemes. Access is authenticated with a client
    certificate issued under a Swisscom Trust Services contract; the request body carries a SAD
    (signature activation data) token authorising the signer, plus a provisioned credentialID.
  spec_gap: true
- surface: api.swisscom.com-marketplace-gateway
  spec: null
  types: [apiKey, oauth2]
  detail: >-
    A client_id header authenticates the messaging products (Text Messaging, Token Validation,
    added-value SMS short-ID lookups). OAuth 2.0 client credentials authenticate the Mobility
    Insights products (Heatmaps, Dwell Times, Origin Destination). The legacy Voice APIs use
    authorization-code or implicit grants via https://consent.swisscom.com. The Swiss AI Platform
    inference endpoints are API-key authenticated and require a signed service contract.
  authorization_endpoint: https://consent.swisscom.com/c/oauth2/auth
  token_endpoint: https://consent.swisscom.com/o/oauth2/token
  docs: https://digital.swisscom.com/resources/use-your-api-keys/oaut-introduction
scopes_detail: scopes/swisscom-scopes.yml