specification: API Commons Authentication
specificationVersion: '0.1'
provider: Yahoo
providerId: yahoo
generated: '2026-08-28'
method: searched
source: >-
  https://developer.yahoo.com/oauth2/guide/ ,
  https://api.login.yahoo.com/.well-known/openid-configuration ,
  https://help.yahooinc.com/dsp-api/docs/authentication ,
  https://help.yahooinc.com/dsp-api/docs/setup-access-guide ,
  https://help.yahooinc.com/dsp-api/docs/authorization-and-headers ,
  https://help.yahooinc.com/datax/docs/security-authentication
docs:
  - https://developer.yahoo.com/oauth2/guide/
  - https://help.yahooinc.com/dsp-api/docs/setup-access-guide
  - https://help.yahooinc.com/datax/docs/security-authentication
description: >-
  Yahoo authenticates every public API surface with OAuth 2.0, but the flows differ sharply by
  product. Consumer-facing APIs (Fantasy Sports, Sign In With Yahoo) use the three-legged
  authorization-code flow against the Yahoo identity service at api.login.yahoo.com, which also
  publishes a full OpenID Connect Discovery document. The ad-tech APIs (DSP Traffic, DSP
  Reporting, DataX, Conversion API) use a two-legged client_credentials flow in which the client
  authenticates with a self-signed JWT and the resulting bearer token is presented in Yahoo's own
  X-Auth-Token / X-Auth-Method header pair rather than in Authorization.
schemes:
  - id: yahoo-oauth2-authorization-code
    type: oauth2
    flow: authorizationCode
    applies_to:
      - Yahoo Fantasy Sports API
      - Sign In With Yahoo
    authorization_endpoint: https://api.login.yahoo.com/oauth2/request_auth
    token_endpoint: https://api.login.yahoo.com/oauth2/get_token
    introspection_endpoint: https://api.login.yahoo.com/oauth2/introspect
    revocation_endpoint: https://api.login.yahoo.com/oauth2/revoke
    userinfo_endpoint: https://api.login.yahoo.com/openid/v1/userinfo
    jwks_uri: https://api.login.yahoo.com/openid/v1/certs
    grant_types:
      - authorization_code
      - refresh_token
    token_endpoint_auth_methods:
      - client_secret_basic
      - client_secret_post
    id_token_signing_algs:
      - ES256
      - RS256
    token_placement: 'Authorization: Bearer <access_token>'
    registration: https://developer.yahoo.com/apps/create/
    docs: https://developer.yahoo.com/oauth2/guide/flows_authcode/
    evidence: https://api.login.yahoo.com/.well-known/openid-configuration (HTTP 200)
  - id: yahoo-openid-connect
    type: openIdConnect
    applies_to:
      - Sign In With Yahoo
    issuer: https://api.login.yahoo.com
    discovery: https://api.login.yahoo.com/.well-known/openid-configuration
    subject_types:
      - public
    response_types:
      - code
      - token
      - id_token
      - code token
      - code id_token
      - token id_token
      - code token id_token
    response_modes:
      - query
    acr_values:
      - AAL1
      - AAL2
    claims:
      - aud
      - email
      - email_verified
      - birthdate
      - exp
      - family_name
      - given_name
      - iat
      - iss
      - locale
      - name
      - sub
      - auth_time
    claims_parameter_supported: false
    request_parameter_supported: false
    request_uri_parameter_supported: false
    docs: https://developer.yahoo.com/oauth2/guide/openid_connect/
    evidence: https://api.login.yahoo.com/.well-known/openid-configuration (HTTP 200)
  - id: yahoo-dsp-client-credentials-jwt
    type: oauth2
    flow: clientCredentials
    applies_to:
      - Yahoo DSP Traffic API
      - Yahoo DSP Reporting API
      - Yahoo Conversion API
      - Yahoo Ad Tech DataX API
    token_endpoint: https://id.b2b.yahooincapis.com/zts/v1/oauth2/token
    client_assertion: >-
      A JSON Web Token signed by the client identifies it to the token endpoint. DSP signs with
      HS256 using the client secret; DataX exchanges an RSA public key generated with OpenSSL and
      emailed to dataoperations@yahooinc.com during onboarding.
    token_placement: >-
      X-Auth-Method: OAuth2 and X-Auth-Token: <access token> headers, alongside
      Content-Type: application/json. The DSP APIs do NOT read the Authorization header.
    token_ttl_seconds: 21600
    token_ttl_note: >-
      DataX raised the access-token TTL from 3600s to 21600s; clients are REQUIRED to cache and
      reuse tokens and read expires_in rather than assume the default.
    credential_issuance: >-
      Client ID and client secret are issued once, in the DSP UI (My Account > Activate), and are
      never redisplayed. A seat user must be created and API-enabled by a User Ops role holder
      before credentials can be generated.
    docs: https://help.yahooinc.com/dsp-api/docs/setup-access-guide
    evidence: https://help.yahooinc.com/dsp-api/docs/authorization-and-headers (HTTP 200)
notes:
  - >-
    The Yahoo Conversion API requires its own separate direct OAuth 2.0 setup even for callers
    already authenticated against the DSP Traffic API.
  - >-
    Yahoo publishes no OpenAPI/Swagger description for any of these surfaces, so this profile is
    searched from the published documentation rather than derived from securitySchemes.
  - >-
    The DSP token endpoint id.b2b.yahooincapis.com/zts/v1 is an Athenz ZTS deployment; Athenz is
    Yahoo's own open-source service-authentication project (github.com/AthenZ).
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com