# October 1, 2026 - X.509 certificate-based authentication for system-to-system integrations

**URL:** <https://community.cumulocity.com/t/october-1-2026-x-509-certificate-based-authentication-for-system-to-system-integrations/15261>\
**Category:** Platform services\
**Tags:** Feature, authentication, platform-services\
**Created:** [October 12, 2026, 7:33am UTC](https://community.cumulocity.com/t/october-1-2026-x-509-certificate-based-authentication-for-system-to-system-integrations/15261 "2026-10-12T07:33:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![cumulocity](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/cumulocity/32/31990_2.png) [@cumulocity](https://community.cumulocity.com/u/cumulocity)\
**Post date:** [October 12, 2026, 7:33am UTC](https://community.cumulocity.com/t/october-1-2026-x-509-certificate-based-authentication-for-system-to-system-integrations/15261/1 "2026-10-12T07:33:37Z")

</div>

## Context

* * *

**Change Type:** Feature  
**Product area:** Platform services  
**Component:** Authentication  
**Deployed at:** [eu.latest.cumulocity.com](http://eu.latest.cumulocity.com), [apj.cumulocity.com](http://apj.cumulocity.com), [jp.cumulocity.com](http://jp.cumulocity.com), [cumulocity.com](http://cumulocity.com), [us.cumulocity.com](http://us.cumulocity.com)

> **Technical details**
>
> **Build artifact:** cumulocity (2026.334.0)  
> **Internal ID:** MTM-65875

## Description

* * *

Cumulocity now supports X.509 certificate-based authentication for system-to-system integrations. This enables secure, passwordless authentication using enterprise Public Key Infrastructure (PKI), replacing static credentials and legacy password grant flows.

- **New endpoint** : A dedicated endpoint (`POST /tenant/oauth/certificate`) allows external applications to exchange valid X.509 client certificate chains for standard Cumulocity platform JWT access tokens.
- **User-controlled opt-in** : Users can enforce certificate authentication on their own accounts by setting the `requiredAuthType` property to `CERTIFICATES`. See [Certificate authentication opt-in](https://cumulocity.com/docs/authentication/oai-secure/#certificate-authentication-opt-in) for details. For security, this is a strict self-service feature: accounts cannot be opted in by third parties or tenant administrators.
- **Audit logging** : Every certificate token request and validation outcome is recorded in the platform audit log for complete security compliance and tracking.
- **Documentation** : See the [Cumulocity OpenAPI Specification](https://cumulocity.com/api/core/#operation/postCertificateAccessToken) for implementation details.