generated: '2026-09-05'
method: searched
source: >-
  https://zendrive-root.bitbucket.io/ios/docs/latest/Classes/ZendriveConfiguration.html ;
  https://zendrive-root.bitbucket.io/ios/docs/latest/Classes/Zendrive.html
name: Zendrive authentication
description: >-
  Zendrive's public integration surface is a mobile SDK, and its authentication model is an
  application key (also called the SDK key) carried in ZendriveConfiguration and validated
  against Zendrive's servers during +[Zendrive setupWithConfiguration:delegate:completionHandler:].
  There is no OAuth surface, no OpenID Connect discovery document, and no publicly reachable
  token endpoint — every /.well-known/openid-configuration and /.well-known/oauth-authorization-server
  probe on every known Zendrive host missed (see well-known/zendrive-well-known.yml). The
  server-side Analytics REST API used a separate credential documented at docs.zendrive.com,
  which is now a dangling Cloudflare CNAME, so that scheme cannot be captured first-hand and
  is deliberately not described here.
surface: mobile-sdk
schemes:
- type: apiKey
  name: applicationKey
  label: Zendrive application key (SDK key)
  in: sdk-configuration
  required: true
  description: >-
    "Your application key. Pass in the application key for your app." REQUIRED, must be a
    valid non-nil string; validated with +[Zendrive isValidInputParameter:]. Setup requires a
    network connection because the key is validated server-side, and returns
    kZendriveErrorInvalidSDKKeyString (0) when the key is rejected and
    kZendriveErrorNetworkUnreachable (1) when validation cannot reach the server.
  issuance:
    documented_url: https://developers.zendrive.com/signup
    status: 0
    note: >-
      The SDK reference still instructs developers to create a key at
      https://developers.zendrive.com/signup. That host has no DNS record; the sample-app
      READMEs point at https://app.zendrive.com/signup, which is also NXDOMAIN. New keys can
      no longer be obtained, so this is a DEAD issuance path and is not wired as a SignUp
      pointer.
- type: identifier
  name: driverId
  label: Driver identifier
  in: sdk-configuration
  required: true
  description: >-
    "Unique ID for the current user. This can be any ID used by your app to identify its
    users. This is the ID which will be used in Zendrive reports." REQUIRED alongside the
    application key; changing it mid-session is equivalent to teardown followed by a fresh
    setup.
  note: >-
    Not a credential — it is the tenant-scoped subject the application key authorizes. Recorded
    because setup fails without it.
session:
  setup: +[Zendrive setupWithConfiguration:delegate:completionHandler:]
  teardown: +[Zendrive teardown...]
  wipe: +[Zendrive wipeOut:]
  note: >-
    Credentials are established once at setup. Changing applicationKey or driverId across
    repeated setups behaves as teardown-then-setup. The data region cannot be changed after
    setup without calling wipeOut first (kZendriveErrorUnauthorizedRegionSwitch, 110).
data_residency:
  parameter: ZendriveConfiguration.region
  values:
  - id: ZendriveRegionUS
    value: 0
    description: User's data will reside in the US region. This is the default.
  - id: ZendriveRegionEU
    value: 1
    description: User's data will reside in the EU region.
  reference: https://zendrive-root.bitbucket.io/ios/docs/latest/Enums/ZendriveRegion.html
  note: >-
    Region is per-application and enforced at setup. An application not provisioned for a
    region receives kZendriveErrorRegionUnsupported (109).
deprovisioning:
  error: kZendriveErrorUserDeprovisioned (111)
  description: User is not authorized to use this application.
gaps:
- No OAuth 2.0 or OIDC surface is published.
- No scopes/ artifact is applicable — the model is a single opaque application key, not a scoped grant.
- >-
  The Analytics REST API credential model (docs.zendrive.com/en/latest/api/) is unrecoverable:
  every host that served it is NXDOMAIN or a dangling CNAME.