> ## Documentation Index
> Fetch the complete documentation index at: https://developers.mypilotindex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> OAuth 2.0 client credentials, the token you send and the scopes it carries.

A partner authenticates with OAuth 2.0 client credentials. The identity provider is Amazon Cognito. MyPilotIndex creates one confidential client for each approved partner, and the client can only use the client credentials flow: no token it receives can ever stand for a pilot.

## Getting a token

Send a POST to the token endpoint of the identity provider's domain, `https://{cognito-domain}/oauth2/token`, with HTTP Basic client authentication (your client id as user name, your client secret as password):

```http theme={null}
POST /oauth2/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic base64(client_id:client_secret)

grant_type=client_credentials&scope=partner/profile partner/score
```

Production uses `auth.mypilotindex.com`. The sandbox uses the dev environment's domain, which we give you with your sandbox credential.

Send the access token in the `Authorization: Bearer` header of every Partner API call. Tokens are issued for 60 minutes when the client is created. Read `expires_in` from the token answer rather than relying on this number, and ask for a new token when it ends.

## Scopes

A token carries only the scopes your partner was approved for. A scope is written `partner/<name>` in the token request and in the token. A grant holds the bare name, for example `hours.write`.

| Scope in the token | What it allows |
| - | - |
| `partner/profile` | Read the pilot's name, photo and username. |
| `partner/score` | Read the pilot's MPI Score and phase. |
| `partner/hours.read` | Read the pilot's flight hours. |
| `partner/hours.write` | Update the pilot's flight hours with the logbook's totals. |
| `partner/licenses` | Read the pilot's licenses, ratings and type ratings. |
| `partner/applications` | Read the pilot's applications to jobs from the partner's company. No route in this version of the reference serves it. |

The exchange, the grants list, the certificate check and the webhook test need no scope, only a valid token. The pilot summary needs the grant and the token to hold at least one of `profile`, `score`, `hours.read` and `licenses`, and shows only the blocks the grant allows. The flight totals push needs `hours.write` in both the token and the grant. If a required scope is missing the answer is `403 forbidden` with reason `scope_missing`.

## Two things that decide a call

* **The token** says who you are and what you may ask a pilot for.
* **The grant** says which pilot allowed you what. Routes that name a grant answer `404 not_found` for a grant that is revoked, unknown or another partner's, always the same way.

A missing, expired or invalid token answers `401`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.