Authentication options
Each Customer API integration uses one or more machine authentication methods. These credentials identify the integration, while its customer, site, line, scope, and data-source policy determine what it can access.
| Method | Best fit | Credential presented |
|---|---|---|
| mTLS | Workloads with managed client certificates and direct access to the dedicated mTLS endpoint | Client certificate during the TLS handshake |
| OIDC OAuth 2.0 | Services that can securely hold an OAuth client credential and request short-lived access tokens | OAuth bearer token |
| Signed JWT | Services that already manage an approved asymmetric signing key | Short-lived signed assertion |
No method uses a Wavac user password. Choose a separate integration for each application or operational owner so one credential can be rotated or revoked without disrupting unrelated clients.
Before setup
- Confirm the integration's required customer, site, and line boundaries.
- Request only the discovery and data scopes the application needs.
- Choose an approved secret or key store before issuing a credential.
- Record an owner and rotation procedure for the authentication method.
- Use discovery as the first authenticated request after setup.
Continue setup
Follow the runnable, commented guide for mTLS, OIDC OAuth 2.0, or signed JWT. Review the security overview before moving an integration into production.