canonical: https://jentic.com/apis/npr.org/npr-authorization-service

# NPR Authorization Service

Jentic publishes the only available OpenAPI specification for NPR Authorization Service, keeping it validated and agent-ready. The NPR Authorization Service is the OAuth 2.0 server backing the NPR One platform. It issues access tokens that the Identity, Listening, and Sponsorship services accept, and supports a device-flow login designed for limited-input devices like smart speakers and connected cars. The three endpoints cover device-flow initiation, token issuance, and token revocation.

## For AI agents

Issue and revoke OAuth 2.0 access tokens for the NPR One platform, including a device flow tailored for smart speakers and connected cars.

## Scope

Does not handle user profiles, audio recommendations, or sponsorship - use for OAuth 2.0 token issuance and revocation across the NPR One platform only.

## Capabilities

- Initiate an OAuth 2.0 device-flow login for limited-input devices like smart speakers and car head units
- Exchange an authorization code or device code for an NPR One access token
- Revoke an issued access token to invalidate a session
- Operate as the OAuth 2.0 server for the wider NPR One developer platform

## Use cases

### Device-Flow Login for Smart Speakers and Cars

NPR One client apps on smart speakers, smart TVs, and connected cars cannot easily prompt for a password. Instead they call POST `/v2/device`, display the returned user code on screen, and ask the listener to authorize the device on their phone. Once approved, polling `/v2/token` returns the access token that unlocks the rest of the NPR One platform.

Example prompt: Call POST `/v2/device` with the registered client_id, render the returned user_code on the device, then poll POST `/v2/token` with grant_type=device_code until a token is returned.

### Token Issuance and Revocation

NPR One client apps issue access tokens at sign-in via POST `/v2/token` and invalidate them on sign-out or compromise via POST `/v2/token/revoke.` Revocation is essential for security incident response and for honoring user-initiated sign-out across multiple devices.

Example prompt: On user sign-out, call POST `/v2/token/revoke` with the active access token to invalidate the session, then clear local credential storage.

### Agent-Driven NPR One Sign-In Bootstrap

An assistant agent enrolling a new listener on a smart speaker walks through the device flow, exchanges the code for an access token, and stores the token in your Jentic One instance. Subsequent calls into Identity or Listening go through Jentic without exposing the token in the agent's context.

Example prompt: Search Jentic for 'start npr one device login', execute POST `/v2/device`, then poll POST `/v2/token` until the listener finishes authorizing on their phone.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/v2/device` | Initiate an OAuth 2.0 device-flow login |
| POST | `/v2/token` | Issue an access token from an authorization or device code |
| POST | `/v2/token/revoke` | Revoke an existing access token |

## Key resources

- **Device authorization** — Initiate the OAuth 2.0 device flow for limited-input devices
- **Tokens** — Issue and revoke OAuth 2.0 access tokens for the NPR One platform

## Why Jentic

- **Setup:** Wiring the NPR Authorization Service by hand means implementing its OAuth 2.0 authorization-code flow, registering device grants, and managing token issuance and revocation against authorization.api.npr.org yourself. Through Jentic you install once, import the NPR Authorization Service from the API Directory, store the client_id and client_secret once, and your agent calls it.
- **Permission scoping:** The token target here travels in the request body rather than the URL path, so scope the agent to the operations it needs, such as starting a device grant or issuing a token. You choose the operations it may call, so token revocation is not included unless you add it.
- **Credential handling:** Your NPR One client_id and client_secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'start an NPR One device login' or 'issue an access token', and Jentic returns the matching Authorization operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **NPR Identity Service** — Use tokens from this service to call user-profile endpoints on Identity.
- **NPR Listening Service** — Listening recommendations require a token issued by Authorization.
- **Auth0** — General-purpose OAuth 2.0 / OIDC authorization server for non-NPR identity needs.
- **Okta** — Enterprise identity and OAuth 2.0 platform for workforce or customer identity.

## FAQ

### Why is there no official OpenAPI spec for NPR Authorization Service?

NPR does not publish an OpenAPI specification for the Authorization Service. Jentic generates and maintains this spec so that AI agents and developers can call NPR Authorization Service via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the NPR Authorization Service use?

The Authorization Service is itself the OAuth 2.0 issuer, so calls into it use a registered NPR One client_id and client_secret rather than an existing access token. Jentic stores the client credentials in its encrypted vault and injects them at call time.

### Can I implement a smart-speaker login with this service?

Yes. POST `/v2/device` starts a device-flow login designed exactly for smart speakers, set-top boxes, and car head units. The device displays a short user_code, the listener authorizes it on their phone, and the device polls `/v2/token` until it receives an access token.

### How do I revoke a leaked NPR One access token through Jentic?

Search Jentic with 'revoke npr access token', load POST `/v2/token/revoke`, and execute it with the compromised token. The token is invalidated server-side immediately, preventing further calls into Identity, Listening, or Sponsorship.

### Which NPR services accept tokens from this Authorization Service?

Tokens issued here are accepted by the NPR Identity Service, NPR Listening Service, and NPR Sponsorship Service. All three resource servers sit behind this single OAuth 2.0 authorization server.

### Can I limit what my agent is allowed to do with the NPR Authorization Service?

Yes. Because you run Jentic One yourself, your own rules decide which of the three NPR Authorization operations the agent may call: starting a device-flow login (POST `/v2/device`), issuing an access token (POST `/v2/token`), and revoking a token (POST `/v2/token/revoke`). Since the token target travels in the request body rather than the URL path, you scope the agent to just the operations it needs, so you can let it start a device grant and issue tokens while leaving revocation out unless you explicitly add it. Your NPR One client_id and client_secret stay stored and encrypted in your own instance and are injected only at execution time, never entering the agent's context.