Welcome to the Schiphol Public Developer Portal! This guide is for anyone who is new to the platform and wants to start consuming our APIs. In just four steps you will have your credentials set up, a token in hand, and your first authenticated API call working.
Before you begin
Make sure you have: access to this Developer Portal · a clear idea of which API(s) you want to use · a secure way to store a secret (environment variables or a secrets manager such as Azure Key Vault).
How it works: at a glance
The Schiphol API platform uses OAuth 2.0 Client Credentials to authenticate API consumers. Here is what you will do:
1
Create an Application
Register an application in the portal to receive your Client ID & Secret.
2
Subscribe to APIs
Link your application to the APIs you need and request access.
3
Get an Access Token
Exchange your credentials for a short-lived JWT token from Auth0.
4
Call the API
Include the token as a Bearer header on every API request.
New to OAuth 2.0? What is Client Credentials flow?
OAuth 2.0 Client Credentials is an authentication method designed for machine-to-machine communication: your application exchanges a Client ID and Client Secret for a short-lived JWT token that you include in every API call.
Tokens expire automatically (after 30 minutes), your secret never travels to the API server, and you can revoke access instantly by rotating credentials in the portal.
Environment Configuration
Token endpointhttps://api-acc.auth.schiphol.nl/oauth/token
API audiencehttps://api-acc.schiphol.nl/public
Step 1: Create an Application
- Log in to this Developer Portal with your account credentials
- Navigate to My Apps in the top navigation
- Click Create Application and fill in the details
- Copy your Client ID and Client Secret
Save your Client Secret now
The Client Secret is shown only once. Store it immediately in a secrets manager or environment variable - if lost, you must generate a new one.
Step 2: Subscribe to APIs
- Browse the API catalogue and open the API you need
- Click Subscribe and select your application
- Wait for approval if required - only Approved subscriptions allow API access
Approval may be required
Some APIs require manual approval before access is granted. Only APIs with an Approved status can be accessed using your token.
Step 3: Get an Access Token
curl --request POST \ --url https://api-acc.auth.schiphol.nl/oauth/token \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data 'grant_type=client_credentials' \ --data 'client_id=YOUR_CLIENT_ID' \ --data 'client_secret=YOUR_CLIENT_SECRET' \ --data 'audience=https://api-acc.schiphol.nl/public'
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 1800
}Token caching tip
Cache the token and reuse it for all API calls. The token is valid for 30 minutes - requesting a new one for every call will trigger rate limit errors.
Step 4: Call the API
curl --request GET \ --url 'https://api-acc.schiphol.nl/public/public-flights/v4/flights' \ --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \ --header 'Accept: application/json'
A 401 means your token has expired. Request a new one. A 403 means your subscription is not yet approved.