authentication_overview.html

Authentication

All of our APIs require authentication. Depending on the use case, we offer different mechanisms.

• Data authorization: must we authorize information on an individual per-user/customer basis?
• Functional authorization: must we authorize individual functions separately?
• What level of security is required?
• How complex may the integration be.

The first three criteria are assessed by Swisscom, based on the user of the API (i.e. you) and the exact application that wants to use the API.

In a nutshell, here's how the scenarios compare.

Auth method	Data AuthZ	Functional AuthZ	Security	Simplicity	Characterization
Client id	No	No	Low	Simple	B2B / B2C
OAuth: client credentials	No	Yes	Medium	Medium	B2B
OAuth: implicit	Yes	Yes	Low	Medium	B2C
OAuth: authorization code	Yes	Yes	High	Complex	B2B2C

Further reading

The details for the above mentioned authentication methods are found in the following tutorials

• Using Client ID
• An overview of OAuth v2
• Using OAuth authorization code
• Using OAuth client credentials
• Using OAuth implicit