The VCDP API uses OAuth2 with DPoP (Demonstrating Proof-of-Possession, RFC 9449) to secure all authenticated endpoints. This ensures that access tokens are cryptographically bound to the client that requested them.
How it works
- Client authenticates with the IdP using OAuth2 (authorization code + PKCE or client credentials)
- The IdP issues a DPoP-bound access token
- Client calls the API with the access token and a fresh DPoP proof JWT
Security model
| Layer | Mechanism |
|---|
| Authentication | OAuth2 Bearer token (JWT) |
| Token binding | DPoP proof (RFC 9449) |
| Key algorithm | ES256 (P-256 ECDSA) |
| Token lifetime | Short-lived (configurable, typically 5 minutes) |
| Replay protection | Unique jti claim per proof, server-side nonce validation |
Supported grant types
- Authorization Code + PKCE — For user-facing applications where a vehicle owner grants consent
- Client Credentials — For server-to-server integrations with pre-approved data access
- Refresh Token — For obtaining new access tokens without re-authentication
Endpoints
| Endpoint | Purpose |
|---|
GET /auth | Initiate authorization code flow (redirects to IdP) |
POST /auth/token | Exchange code for tokens, refresh tokens, or obtain client credentials tokens |
Next steps