generated: '2026-09-02'
method: searched
source: https://developer.unico.io/developers/api-reference/authentication
docs: https://developer.unico.io/developers/api-reference/authentication
note: >-
  Unico runs OAuth2 with the RFC 7523 JWT-bearer grant, but it does NOT publish a scope
  catalogue. The documented assertion carries a single wildcard scope claim, and
  authorization is expressed through the provisioned APIKEY (which capabilities the tenant's
  key enables) rather than through per-endpoint scopes. This is an honest record of that
  design, not a gap in our search: the Authentication page states the scope value verbatim
  and no permissions/scopes reference page exists anywhere in the developer.unico.io sitemap
  (184 URLs walked, 2026-09-02).
scheme: oauth2
grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
token_endpoint: https://identity.acesso.io/oauth2/token
scope_count: 1
scopes:
- name: '*'
  description: >-
    Wildcard scope asserted in the JWT `scope` claim. Documented verbatim as "grants all
    permissions" for the authenticated service account.
  source: https://developer.unico.io/developers/api-reference/authentication
authorization_model:
  granularity: tenant + api-key
  description: >-
    Effective permissions are bound to the APIKEY provisioned for the project, which selects
    the active product (Onboarding, Transactional, Cardholder Verification) and the capability
    recipe (flow) executed. Enabling a new capability requires Unico to reissue the key —
    the upgrade guide states this explicitly.
  evidence: https://developer.unico.io/developers/api-reference/api/upgrade-guide
per_endpoint_scopes_published: false