Skip to main content

Authentication and Authorization

Swisscom Validator APIs are accessed through the Swisscom Digital Marketplace.

Swisscom Digital Marketplace Authentication Model​

  1. Subscribe to the product on Swisscom Digital Marketplace
  2. Retrieve your credentials (CLIENT_ID and CLIENT_SECRET) from the Digital Marketplace
  3. Request an access token from the token endpoint using the OAuth 2.0 client credentials grant.

Endpoint Access Token​

EnvironmentMethodEndpoint
StagingPOSThttps://api.staging.swisscom.com/products/oauth2/token
ProductionPOSThttps://api.swisscom.com/products/oauth2/token

Get Access Tokens​

The token endpoint follows the standard OAuth 2.0 client credentials pattern. Pass your CLIENT_ID and CLIENT_SECRET as HTTP Basic credentials and include the SCS-Version: 1 header.

curl -sS -X POST "https://api.staging.swisscom.com/products/oauth2/token" \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "SCS-Version: 1" \
  -d "grant_type=client_credentials"

The response contains an access_token field. Use it as a Bearer token on subsequent API requests:

curl -H "Authorization: Bearer $TOKEN" "$BASE_URL/<endpoint>"

Common Auth Failures​

  • 400 Bad Request: malformed token request body or missing required fields.
  • 401 Unauthorized: missing, expired, or invalid Authorization header on the API request; invalid CLIENT_ID or CLIENT_SECRET on the token request.

For a full list of status codes and handling guidance, see the product's Errors and Status Codes reference.