The DeepCredentials B2B API authenticates every call with a DeepAdmin service-user JWT obtained from the DeepCloud SSO realm. There is no portal-side credential to mint — identity is delegated to DeepCloud's IdP (Keycloak), and the portal verifies tokens at request time.
Every B2B request carries three headers:
| Header | Value |
|---|---|
Authorization | Bearer <access_token> from the DeepCloud SSO token endpoint. |
X-Org-Id | UUID of the organization the call is acting on; the service user must be a member. |
X-Environment | beta or production. Resources are isolated per environment. |
Start here:
- Service Users — the canonical guide: how to get a partner client and a service user from DeepCloud, exchange credentials for an access token, request scopes, call the API, and the full error reference.
All B2B endpoints gate access on the JWT's scope claim. Request explicitly via the scope=… form parameter on the token call; only the scopes your integration uses.
| Scope | Grants access to |
|---|---|
deepcredentials.verify | Create and read OID4VP verification sessions. |
deepcredentials.issue | Create credential offers, list and inspect issued credentials, suspend / revoke / reactivate. |
deepcredentials.self-service | Read and decide on end-user-initiated self-service requests. |
Least privilege
Only request the scopes your integration actually needs. If you only verify identities, scope=deepcredentials.verify is sufficient.