Authentication

A partner authenticates with OAuth 2.0 client credentials. The identity provider is Amazon Cognito. MyPilotIndex creates one confidential client for each approved partner, and the client can only use the client credentials flow: no token it receives can ever stand for a pilot.

Getting a token

Send a POST to the token endpoint of the identity provider’s domain, https://{cognito-domain}/oauth2/token, with HTTP Basic client authentication (your client id as user name, your client secret as password):

POST /oauth2/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic base64(client_id:client_secret)

grant_type=client_credentials&scope=partner/profile partner/score

Production uses auth.mypilotindex.com. The sandbox uses the dev environment’s domain, which we give you with your sandbox credential. Send the access token in the Authorization: Bearer header of every Partner API call. Tokens are issued for 60 minutes when the client is created. Read expires_in from the token answer rather than relying on this number, and ask for a new token when it ends.

Scopes

A token carries only the scopes your partner was approved for. A scope is written partner/<name> in the token request and in the token. A grant holds the bare name, for example hours.write.

Scope in the token	What it allows
`partner/profile`	Read the pilot’s name, photo and username.
`partner/score`	Read the pilot’s MPI Score and phase.
`partner/hours.read`	Read the pilot’s flight hours.
`partner/hours.write`	Update the pilot’s flight hours with the logbook’s totals.
`partner/licenses`	Read the pilot’s licenses, ratings and type ratings.
`partner/applications`	Read the pilot’s applications to jobs from the partner’s company. No route in this version of the reference serves it.

The exchange, the grants list, the certificate check and the webhook test need no scope, only a valid token. The pilot summary needs the grant and the token to hold at least one of profile, score, hours.read and licenses, and shows only the blocks the grant allows. The flight totals push needs hours.write in both the token and the grant. If a required scope is missing the answer is 403 forbidden with reason scope_missing.

Two things that decide a call

The token says who you are and what you may ask a pilot for.
The grant says which pilot allowed you what. Routes that name a grant answer 404 not_found for a grant that is revoked, unknown or another partner’s, always the same way.

A missing, expired or invalid token answers 401.

Get started

Core concepts

Reference

Getting a token

Scopes

Two things that decide a call

​Getting a token

​Scopes

​Two things that decide a call

Getting a token

Scopes

Two things that decide a call