generated: '2026-07-25'
method: searched
source: https://docs.api.totogi.com/
docs: https://docs.api.totogi.com/
note: >-
  Totogi has no single authentication model — it runs three separate credential systems across
  three separate API surfaces, and none of them share an issuer. Derived mechanically where a
  spec existed and read from Totogi's own published documentation and demo code everywhere else.
summary:
  types: [oauth2, http]
  api_key_in: []
  oauth2_flows: [clientCredentials]
  http_schemes: [bearer, basic]
  openid_connect: false
  mutual_tls: false
  discovery_documents: none
schemes:
- name: OAuth 2.0 client credentials (Charging-as-a-Service GraphQL)
  type: oauth2
  flow: clientCredentials
  token_url: https://oauth.totogi.io/oauth2/token
  client_auth: HTTP Basic (base64 of client_key:client_secret) on the token request
  applies_to:
  - https://gql.produseast1.api.totogi.com/graphql
  - https://gql.prodapsoutheast1.api.totogi.com/graphql
  - https://api.totogi.io/graphql
  authorization_model: named-roles
  roles_artifact: scopes/totogi-scopes.yml
  credential_management:
    note: >-
      Tenant clients are minted through the API itself — createClientCredentials,
      getClientCredentials, listAllClientCredentials, updateClientCredentials and
      deleteClientCredentials are published GraphQL operations gated on the Tenant_Admin role,
      and ClientCreationLimitExceeded is a typed error carrying currentClientCount/maxClientLimit.
  evidence:
  - source: https://github.com/totogi/marketplace-api-demo
    detail: >-
      Totogi's own published demo posts grant_type=client_credentials with a Basic-encoded
      key:secret to https://oauth.totogi.io/oauth2/token and sends the returned access_token
      as the Authorization header on https://api.totogi.io/graphql.
  - source: https://www.totogi.com/how-to-guides/build-a-charging-emulator-demo-app-using-totogi-apis/
    detail: '"Access to Totogi APIs is limited to authorized OAuth 2.0 tokens."'
  probes:
  - {url: 'https://api.totogi.io/graphql', status: 401, body: 'UnauthorizedException — "Valid authorization header not provided." (AWS AppSync)'}
  - {url: 'https://oauth.totogi.io/.well-known/openid-configuration', status: 403}
  - {url: 'https://oauth.totogi.io/.well-known/oauth-authorization-server', status: 403}
- name: Bearer id token (5G converged charging)
  type: http
  scheme: bearer
  bearer_format: JWT id token
  applies_to:
  - https://5g.produseast1.api.totogi.com/nchf-convergedcharging/v3/chargingData
  - https://5g.prodapsoutheast1.api.totogi.com/nchf-convergedcharging/v3/chargingData
  evidence:
  - source: https://github.com/totogi/totogi-charging-proxy
    detail: >-
      Totogi's published proxy forwards charging requests over HTTP/2 with
      Authorization: Bearer <idToken> and hard-allowlists the two 3GPP Nchf endpoints above.
  probes:
  - {url: 'https://5g.produseast1.api.totogi.com', status: 403}
  - {url: 'https://5g.prodapsoutheast1.api.totogi.com', status: 403}
- name: HTTP Basic — Account SID and Auth Token (Whoosh messaging)
  type: http
  scheme: basic
  username: AccountSid
  password: AuthToken
  applies_to:
  - https://api.whoosh.totogi.solutions/2010-04-01/Accounts/{AccountSid}/Messages.json
  issued_from: https://console.whoosh.totogi.solutions
  evidence:
  - source: https://docs.whoosh.totogi.solutions/send_message
    detail: >-
      The published curl quickstart authenticates with -u $TWILIO_ACCOUNT_SID:$TWILIO_AUTH_TOKEN.
      The Twilio credential model is reproduced exactly, down to the environment-variable names
      every Whoosh SDK reads.
  note: There is no self-serve signup; credentials are issued by Totogi through the operator.
gaps:
- No OpenID Connect discovery document is published on any host.
- No mutual-TLS, no API-key-in-header scheme, and no signed-request scheme is documented.
- >-
  The OAuth authorization-server metadata is unreachable anonymously (403), so token lifetime,
  supported grants and the canonical scope list cannot be verified without a tenant credential.