Skip to Content
TwinsAdobe IMS

Adobe IMS

Twin of Adobe's Identity Management System, the Sign in with Adobe provider.

The OAuth 2.0 and OpenID Connect issuer behind Sign in with Adobe. It mints the tokens the Frame.io twin verifies.

Coversims-na1.adobelogin.com
AuthOAuth client id and secret, bearer access tokens
Issues tokens forFrame.io
Operations8

Coverage

Two grants: authorization code and refresh token. The endpoints behind them are authorize, token, OIDC userinfo, the Adobe profile endpoint, discovery and JWKS, each on Adobe’s own host and path. Frame.io API traffic goes to the Frame.io twin.

This twin is added to your environment automatically when you ask for Frame.io, so you rarely request it directly.

Credentials

Any well-formed client id and secret authenticate by default. Set auth.mode to enforced to accept only the client the world knows. See Credentials.

Vendor specific details

  • A bad authorization code or a bad refresh token is 400 access_denied, not the invalid_grant the spec calls for. Code that branches on the error name takes a different path here, and takes the same different path against real Adobe.
  • The token endpoint reads form bodies only. The identical parameters sent as JSON are never parsed, so the request answers exactly as if you had sent nothing: “missing client_id parameter”.
  • Scopes are comma delimited, not space delimited.
  • A wrong client secret is 400 invalid_client with no WWW-Authenticate challenge, where the RFC would use 401.
  • The access token is a JWT that carries no iss and no aud, only a type claim, so ordinary JWT validation with an expected issuer fails on it. Verify the id token against the JWKS instead.

Its own notes

Once a sandbox is running, this twin serves its own operating notes at {control_url}/veris/manual: the credentials it accepts, the API versions it serves, and the fault statuses you can arm against it. They are generated from the same source as its behaviour, so they cannot drift.

Acuity SchedulingAirtable