SWISS TOURISTY
Start
OAuth 2.0 client credentials against Auth0. Discovery needs no token; quoting and checkout do.
Two things that cost people an afternoon
The audience is an identifier, not an address. It looks like a URL and is never fetched. Requesting a token without it, or trying to call it, are the two most common first mistakes.
Dynamic client registration is disabled on the tenant. An MCP client that registers itself will complete discovery and then fail at the authorize step with nothing useful in the error. Credentials are issued by hand — see request access.
curl --request POST \
--url https://swisstouristy.eu.auth0.com/oauth/token \
--header 'content-type: application/json' \
--data '{
"client_id": "YOUR_CLIENT_ID",
"client_secret": "YOUR_CLIENT_SECRET",
"audience": "https://api.swisstouristy.com/public/v1",
"grant_type": "client_credentials"
}'Then send it as an ordinary bearer token. The scheme match is case-insensitive.
curl https://swisstouristy.com/api/public/v1/quotes \
--header "Authorization: Bearer $ST_ACCESS_TOKEN"Least privilege, with no superset. A broader scope is never accepted as a substitute for the right one, and there is no admin or wildcard scope on this surface.
| Scope | What it permits |
|---|---|
| checkout:prepare | Hand a traveler to Swiss Touristy's hosted checkout for a live quote of your own. Creates no booking and takes no payment. |
| discovery | Connect to the MCP server. Required by the MCP transport on every connection; no REST operation requires it, and the REST discovery endpoints are anonymous. |
| quote:create | Create a quote of your own. |
| quote:read-own | Read a quote you created. Never another caller's. |
discovery is required by the MCP transport on every connection, and by no REST operation — the REST discovery endpoints are anonymous. If you are integrating over MCP, request it; if you are only calling REST, you will never need it.
Missing, expired, malformed and insufficient-scope tokens all return the same AUTHENTICATION_REQUIRED. That is deliberate — telling a caller which of those it was is a probing aid, and a legitimate integration knows which token it sent. Repeated failures are throttled against their own tier, so a credential-guessing loop slows itself down.