Authentication and Authorization

Swisscom Validator APIs are accessed through the Swisscom Digital Marketplace.

Swisscom Digital Marketplace Authentication Model

1. Subscribe to the product on Swisscom Digital Marketplace
2. Retrieve your credentials (CLIENT_ID and CLIENT_SECRET) from the Digital Marketplace
3. Request an access token from the token endpoint using the OAuth 2.0 client credentials grant.

Endpoint Access Token

Environment	Method	Endpoint
Staging	POST	https://api.staging.swisscom.com/products/oauth2/token
Production	POST	https://api.swisscom.com/products/oauth2/token

Get Access Tokens

The token endpoint follows the standard OAuth 2.0 client credentials pattern. Pass your CLIENT_ID and CLIENT_SECRET as HTTP Basic credentials and include the SCS-Version: 1 header.

curl -sS -X POST "https://api.staging.swisscom.com/products/oauth2/token" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "SCS-Version: 1" \
  -d "grant_type=client_credentials"

The response contains an access_token field. Use it as a Bearer token on subsequent API requests:

curl -H "Authorization: Bearer $TOKEN" "$BASE_URL/<endpoint>"

Common Auth Failures

• 400 Bad Request: malformed token request body or missing required fields.
• 401 Unauthorized: missing, expired, or invalid Authorization header on the API request; invalid CLIENT_ID or CLIENT_SECRET on the token request.

For a full list of status codes and handling guidance, see the product's Errors and Status Codes reference.

For error and status code handling, see Errors and Status Codes.