What authentication does the NPR Authorization Service use?

The Authorization Service is itself the OAuth 2.0 issuer, so calls into it use a registered NPR One client_id and client_secret rather than an existing access token. Jentic stores the client credentials in its encrypted vault and injects them at call time.

Can I implement a smart-speaker login with this service?

Yes. POST /v2/device starts a device-flow login designed exactly for smart speakers, set-top boxes, and car head units. The device displays a short user_code, the listener authorizes it on their phone, and the device polls /v2/token until it receives an access token.

How do I revoke a leaked NPR One access token through Jentic?

Search Jentic with 'revoke npr access token', load POST /v2/token/revoke, and execute it with the compromised token. The token is invalidated server-side immediately, preventing further calls into Identity, Listening, or Sponsorship.

Which NPR services accept tokens from this Authorization Service?

Tokens issued here are accepted by the NPR Identity Service, NPR Listening Service, and NPR Sponsorship Service. All three resource servers sit behind this single OAuth 2.0 authorization server.

Can I limit what my agent is allowed to do with the NPR Authorization Service?

Yes. Because you run Jentic One yourself, your own rules decide which of the three NPR Authorization operations the agent may call: starting a device-flow login (POST /v2/device), issuing an access token (POST /v2/token), and revoking a token (POST /v2/token/revoke). Since the token target travels in the request body rather than the URL path, you scope the agent to just the operations it needs, so you can let it start a device grant and issue tokens while leaving revocation out unless you explicitly add it. Your NPR One client_id and client_secret stay stored and encrypted in your own instance and are injected only at execution time, never entering the agent's context.