NPR Authorization Service

Name: NPR Authorization Service API
Brand: NPR Authorization Service
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthenticationoauth23 Endpoints

Install Jentic One Beta

Connect the NPR Authorization Service to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the NPR Authorization Service, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fnpr.org%2Fnpr-authorization" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fnpr.org%2Fnpr-authorization" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with NPR Authorization Service API.

Initiate an OAuth 2.0 device-flow login for limited-input devices like smart speakers and car head units

Exchange an authorization code or device code for an access token at the /v2/token endpoint

Revoke an existing access token to invalidate a session at the /v2/token/revoke endpoint

GET STARTED

Start building with NPR Authorization Service API

Explore with Jentic One

View OpenAPI Document

For Agents

Issue and revoke OAuth 2.0 access tokens for the NPR One platform, including device-flow login for smart speakers and connected cars.

Use for: I need to start an OAuth device-flow login for a connected car head unit, Exchange an authorization code for an NPR One access token, Revoke a leaked NPR One access token immediately, Get an access token for the NPR Listening Service

Not supported: Does not handle user profiles, audio recommendations, or sponsorship - use for OAuth 2.0 token issuance and revocation across the NPR One platform only.

Use Cases

Patterns agents use NPR Authorization Service API for, with concrete tasks.

★ Device-Flow Login for Smart Speakers

Manufacturers building NPR One into a smart speaker, smart TV, or connected car cannot easily prompt for a username and password. Instead they call POST /v2/device, display the returned user code on screen, and ask the listener to authorize the device on their phone. Once the user approves, polling /v2/token returns the access token that unlocks the rest of the NPR One platform.

Call POST /v2/device with the client_id, display the returned user_code, then poll POST /v2/token with grant_type=device_code until an access token is returned.

Token Lifecycle Management

Operators of NPR One client apps issue and revoke access tokens as users sign in and sign out. POST /v2/token covers all standard grants and POST /v2/token/revoke invalidates a token immediately, which is critical for security incident response when a device is lost or a token is leaked.

On a sign-out event, call POST /v2/token/revoke with the user's access token to immediately invalidate the session before clearing local storage.

Agent-Driven NPR One Authentication Bootstrap

An assistant agent enrolling a new listener on a smart device walks through the device flow, exchanges the code for a token, and stores the token in the Jentic credential vault for future calls into the Identity and Listening services. The agent does not need to handle raw OAuth state machines - Jentic exposes each step as a discrete operation.

Search Jentic for 'start npr one device login', execute POST /v2/device, then poll POST /v2/token until the listener completes authorization on their phone.

Key Endpoints

3 endpoints — jentic publishes the only available openapi specification for npr authorization service, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/v2/device

Initiate an OAuth 2.0 device-flow login

POST

/v2/token

Issue an access token from an authorization or device code

POST

/v2/token/revoke

Revoke an existing access token

POST

/v2/device

Initiate an OAuth 2.0 device-flow login

POST

/v2/token

Issue an access token from an authorization or device code

POST

/v2/token/revoke

Revoke an existing access token

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the NPR Authorization Service by hand means implementing its OAuth 2.0 authorization-code flow, registering device grants, and managing token issuance and revocation against authorization.api.npr.org yourself. Through Jentic you install once, import the NPR Authorization Service from the API Directory, store the client_id and client_secret once, and your agent calls it.

Permission scoping

The token target here travels in the request body rather than the URL path, so scope the agent to the operations it needs, such as starting a device grant or issuing a token. You choose the operations it may call, so token revocation is not included unless you add it.

Credential isolation

Your NPR One client_id and client_secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'start an NPR One device login' or 'issue an access token', and Jentic returns the matching Authorization operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

FAQs

Specific to using NPR Authorization Service API through Jentic.

Why is there no official OpenAPI spec for NPR Authorization Service?

NPR does not publish an OpenAPI specification for the Authorization Service. Jentic generates and maintains this spec so that AI agents and developers can call NPR Authorization Service via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the NPR Authorization Service use?

The Authorization Service is itself the OAuth 2.0 issuer, so calls into it use a registered NPR One client_id and client_secret rather than an existing access token. Jentic stores the client credentials in its encrypted vault and injects them at call time, so agents never see the raw secret.

Can I implement a smart-speaker login with the NPR Authorization Service?

Yes. POST /v2/device starts a device-flow login designed exactly for smart speakers, set-top boxes, and car head units. The device displays a short user_code, the listener authorizes it on their phone, and the device polls /v2/token until it gets back an access token.

How do I revoke a leaked NPR One access token through Jentic?

Search Jentic with 'revoke npr access token', load POST /v2/token/revoke, and execute it with the compromised token. The token is invalidated server-side immediately, preventing further calls into the Identity, Listening, or Sponsorship services.

Which NPR services accept tokens issued by the Authorization Service?

Tokens issued here are accepted by the NPR Identity Service (https://identity.api.npr.org), NPR Listening Service (https://listening.api.npr.org), and NPR Sponsorship Service (https://sponsorship.api.npr.org). All three sit behind the same OAuth 2.0 authorization server.

Can I limit what my agent is allowed to do with the NPR Authorization Service?

Yes. Because Jentic One is self-hosted, you set the rules that decide which operations and credentials your agent may use. You can allow it to start a device-flow login (POST /v2/device) and issue tokens (POST /v2/token) while withholding revocation (POST /v2/token/revoke) unless you explicitly add it. Your NPR One client_id and client_secret are stored by your own instance and injected only for the operations you permit, so the agent never handles the raw secret.

NPR Authorization Service

Connect the NPR Authorization Service to your agent

Capabilities

Start building with NPR Authorization Service API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs