Welcome to the Schiphol Public Developer Portal! This guide is for anyone who is new to the platform and wants to start consuming our APIs. In just four steps you will have your credentials set up, a token in hand, and your first authenticated API call working.
Make sure you have: access to this Developer Portal · a clear idea of which API(s) you want to use · a secure way to store a secret (environment variables or a secrets manager such as Azure Key Vault).
How it works: at a glance
The Schiphol API platform uses OAuth 2.0 Client Credentials to authenticate API consumers. Here is what you will do:
Register an application in the portal to receive your Client ID & Secret.
Link your application to the APIs you need and request access.
Exchange your credentials for a short-lived JWT token from Auth0.
Include the token as a Bearer header on every API request.
New to OAuth 2.0? What is Client Credentials flow?
OAuth 2.0 Client Credentials is an authentication method designed for machine-to-machine communication: your application exchanges a Client ID and Client Secret for a short-lived JWT token that you include in every API call.
Tokens expire automatically (after 30 minutes), your secret never travels to the API server, and you can revoke access instantly by rotating credentials in the portal.
Environment Configuration
Step 1: Create an Application
- Log in to this Developer Portal with your account credentials
- Navigate to My Apps in the top navigation
- Click Create Application and fill in the details
- Copy your Client ID and Client Secret
The Client Secret is shown only once. Store it immediately in a secrets manager or environment variable - if lost, you must generate a new one.
Step 2: Subscribe to APIs
- Browse the API catalogue and open the API you need
- Click Subscribe and select your application
- Wait for approval if required - only Approved subscriptions allow API access
Some APIs require manual approval before access is granted. Only APIs with an Approved status can be accessed using your token.
Step 3: Get an Access Token
curl --request POST \ --url https://api.auth.schiphol.nl/oauth/token \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data 'grant_type=client_credentials' \ --data 'client_id=YOUR_CLIENT_ID' \ --data 'client_secret=YOUR_CLIENT_SECRET' \ --data 'audience=https://api.schiphol.nl/public'
The audience tells Auth0 which API you want a token for. It must match the tier and environment of the API you will call - use the API audience value from the configuration section above (for the public tier this ends in /public). A mismatch results in a 401 or 403. Each token is scoped to this audience only, so request a separate token if you call APIs in another tier.
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 1800
}Cache the token and reuse it for all API calls. The token is valid for 30 minutes - requesting a new one for every call will trigger rate limit errors.
Step 4: Call the API
curl --request GET \ --url 'https://api.schiphol.nl/public/public-flights/v4/flights' \ --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \ --header 'Accept: application/json'
A 401 means your token has expired. Request a new one. A 403 means your subscription is not yet approved.