canonical: https://jentic.com/apis/npr.org/npr-authorization

# NPR Authorization Service

Jentic publishes the only available OpenAPI specification for NPR Authorization Service, keeping it validated and agent-ready. The NPR Authorization Service is the OAuth 2.0 server that issues access tokens for the wider NPR One platform, including the Identity, Listening, and Sponsorship services. It supports a device-flow login for limited-input devices like smart speakers and connected cars, plus standard token issuance and revocation. Authentication into all other NPR services requires an access token issued by this service.

## For AI agents

Issue and revoke OAuth 2.0 access tokens for the NPR One platform, including device-flow login for smart speakers and connected cars.

## Scope

Does not handle user profiles, audio recommendations, or sponsorship - use for OAuth 2.0 token issuance and revocation across the NPR One platform only.

## Capabilities

- Initiate an OAuth 2.0 device-flow login for limited-input devices like smart speakers and car head units
- Exchange an authorization code or device code for an access token at the `/v2/token` endpoint
- Revoke an existing access token to invalidate a session at the `/v2/token/revoke` endpoint
- Issue tokens scoped to the Identity, Listening, and Sponsorship NPR One services

## Use cases

### Device-Flow Login for Smart Speakers

Manufacturers building NPR One into a smart speaker, smart TV, or connected car cannot easily prompt for a username and password. Instead they call POST `/v2/device`, display the returned user code on screen, and ask the listener to authorize the device on their phone. Once the user approves, polling `/v2/token` returns the access token that unlocks the rest of the NPR One platform.

Example prompt: Call POST `/v2/device` with the client_id, display the returned user_code, then poll POST `/v2/token` with grant_type=device_code until an access token is returned.

### Token Lifecycle Management

Operators of NPR One client apps issue and revoke access tokens as users sign in and sign out. POST `/v2/token` covers all standard grants and POST `/v2/token/revoke` invalidates a token immediately, which is critical for security incident response when a device is lost or a token is leaked.

Example prompt: On a sign-out event, call POST `/v2/token/revoke` with the user's access token to immediately invalidate the session before clearing local storage.

### Agent-Driven NPR One Authentication Bootstrap

An assistant agent enrolling a new listener on a smart device walks through the device flow, exchanges the code for a token, and stores the token in the Jentic credential vault for future calls into the Identity and Listening services. The agent does not need to handle raw OAuth state machines - Jentic exposes each step as a discrete operation.

Example prompt: Search Jentic for 'start npr one device login', execute POST `/v2/device`, then poll POST `/v2/token` until the listener completes authorization on their phone.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | `/v2/device` | Initiate an OAuth 2.0 device-flow login |
| POST | `/v2/token` | Issue an access token from an authorization or device code |
| POST | `/v2/token/revoke` | Revoke an existing access token |

## Key resources

- **Device authorization** — Initiate the OAuth 2.0 device flow for limited-input devices
- **Tokens** — Issue and revoke OAuth 2.0 access tokens for the NPR One platform

## Why Jentic

- **Setup:** Wiring the NPR Authorization Service by hand means implementing its OAuth 2.0 authorization-code flow, registering device grants, and managing token issuance and revocation against authorization.api.npr.org yourself. Through Jentic you install once, import the NPR Authorization Service from the API Directory, store the client_id and client_secret once, and your agent calls it.
- **Permission scoping:** The token target here travels in the request body rather than the URL path, so scope the agent to the operations it needs, such as starting a device grant or issuing a token. You choose the operations it may call, so token revocation is not included unless you add it.
- **Credential handling:** Your NPR One client_id and client_secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'start an NPR One device login' or 'issue an access token', and Jentic returns the matching Authorization operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **NPR Identity Service** — Use tokens from this service to call user-profile endpoints on Identity.
- **NPR Listening Service** — Listening recommendations and history require a token issued by Authorization.
- **Auth0** — General-purpose OAuth 2.0 / OIDC authorization server for non-NPR identity needs.
- **Okta** — Enterprise identity and OAuth 2.0 platform for workforce and customer identity.

## FAQ

### Why is there no official OpenAPI spec for NPR Authorization Service?

NPR does not publish an OpenAPI specification for the Authorization Service. Jentic generates and maintains this spec so that AI agents and developers can call NPR Authorization Service via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the NPR Authorization Service use?

The Authorization Service is itself the OAuth 2.0 issuer, so calls into it use a registered NPR One client_id and client_secret rather than an existing access token. Jentic stores the client credentials in its encrypted vault and injects them at call time, so agents never see the raw secret.

### Can I implement a smart-speaker login with the NPR Authorization Service?

Yes. POST `/v2/device` starts a device-flow login designed exactly for smart speakers, set-top boxes, and car head units. The device displays a short user_code, the listener authorizes it on their phone, and the device polls `/v2/token` until it gets back an access token.

### How do I revoke a leaked NPR One access token through Jentic?

Search Jentic with 'revoke npr access token', load POST `/v2/token/revoke`, and execute it with the compromised token. The token is invalidated server-side immediately, preventing further calls into the Identity, Listening, or Sponsorship services.

### Which NPR services accept tokens issued by the Authorization Service?

Tokens issued here are accepted by the NPR Identity Service (https://identity.api.npr.org), NPR Listening Service (https://listening.api.npr.org), and NPR Sponsorship Service (https://sponsorship.api.npr.org). All three sit behind the same OAuth 2.0 authorization server.

### Can I limit what my agent is allowed to do with the NPR Authorization Service?

Yes. Because Jentic One is self-hosted, you set the rules that decide which operations and credentials your agent may use. You can allow it to start a device-flow login (POST `/v2/device`) and issue tokens (POST `/v2/token`) while withholding revocation (POST `/v2/token/revoke`) unless you explicitly add it. Your NPR One client_id and client_secret are stored by your own instance and injected only for the operations you permit, so the agent never handles the raw secret.