{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-docs/guides/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Authentication"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"authentication","__idx":0},"children":["Authentication"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The DeepCredentials B2B API authenticates every call with a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["DeepAdmin service-user JWT"]}," obtained from the DeepCloud SSO realm. There is no portal-side credential to mint — identity is delegated to DeepCloud's IdP (Keycloak), and the portal verifies tokens at request time."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every B2B request carries three headers:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Header"},"children":["Header"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Value"},"children":["Value"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Bearer <access_token>"]}," from the DeepCloud SSO token endpoint."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Org-Id"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["UUID of the organization the call is acting on; the service user must be a member."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["X-Environment"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["beta"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["production"]},". Resources are isolated per environment."]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Start here:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/docs/guides/authentication/service-users"},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Service Users"]}]}," — the canonical guide: how to get a partner client and a service user from DeepCloud, exchange credentials for an access token, request scopes, call the API, and the full error reference."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"scopes","__idx":1},"children":["Scopes"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["All B2B endpoints gate access on the JWT's ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope"]}," claim. Request explicitly via the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope=…"]}," form parameter on the token call; only the scopes your integration uses."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Scope"},"children":["Scope"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Grants access to"},"children":["Grants access to"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.verify"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create and read OID4VP verification sessions."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.issue"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Create credential offers, list and inspect issued credentials, suspend / revoke / reactivate."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["deepcredentials.self-service"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Read and decide on end-user-initiated self-service requests."]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"Least privilege"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Only request the scopes your integration actually needs. If you only verify identities, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["scope=deepcredentials.verify"]}," is sufficient."]}]}]},"headings":[{"value":"Authentication","id":"authentication","depth":1},{"value":"Scopes","id":"scopes","depth":2}],"frontmatter":{"seo":{"title":"Authentication"}},"lastModified":"2026-06-10T12:08:36.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/docs/guides/authentication","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}