October 1, 2026 - X.509 certificate-based authentication for system-to-system integrations

Change Log Platform services
, ,
1

Context

Change Type: Feature
Product area: Platform services
Component: Authentication
Deployed at: eu.latest.cumulocity.com, apj.cumulocity.com, jp.cumulocity.com, cumulocity.com, us.cumulocity.com

Technical details

Build artifact: cumulocity (2026.334.0)
Internal ID: MTM-65875

Description

Cumulocity now supports X.509 certificate-based authentication for system-to-system integrations. This enables secure, passwordless authentication using enterprise Public Key Infrastructure (PKI), replacing static credentials and legacy password grant flows.

  • New endpoint: A dedicated endpoint (POST /tenant/oauth/certificate) allows external applications to exchange valid X.509 client certificate chains for standard Cumulocity platform JWT access tokens.
  • User-controlled opt-in: Users can enforce certificate authentication on their own accounts by setting the requiredAuthType property to CERTIFICATES. See Certificate authentication opt-in for details. For security, this is a strict self-service feature: accounts cannot be opted in by third parties or tenant administrators.
  • Audit logging: Every certificate token request and validation outcome is recorded in the platform audit log for complete security compliance and tracking.
  • Documentation: See the Cumulocity OpenAPI Specification for implementation details.