Skip to main content
Send API credentials as an HTTP bearer token.
The production OpenAPI document is authoritative for the active security schemes, issuer, token endpoint, and required scopes. Credentials are provisioned for approved organizations during onboarding.

​
OAuth contract

The Auth0-based contract defines two alternatives:
  • userOAuth uses the authorization-code flow for a person acting in one organization. Each operation includes the baseline org:use scope plus its resource permissions.
  • machineOAuth uses client credentials for an organization-bound service. Its grant must include every scope named by the operation.

​
Protected-resource metadata

OAuth clients can discover API resource metadata at:
On a 401 response, inspect the WWW-Authenticate header for the resource-metadata location.

​
Token handling

  • Never put a bearer token in a query parameter.
  • Never forward an API token to the MCP endpoint. MCP uses its own audience and exchanges delegated authority for an API token.
  • Request only the scopes your integration needs.
  • Keep user tokens and machine credentials in separate storage and rotation policies.
  • Treat 401 as an invalid or unusable credential and 403 as a verified credential without sufficient authority.

​
Organization machine credentials

A machine integration uses an approved OAuth client and an organization-scoped client grant. It exchanges its credentials for a short-lived access token for the API audience. This is OAuth Client Credentials, not an API key that selects an organization when attached to a request. An organization parameter in a token request only selects an organization the client is already authorized to access. The API derives tenant authority from verified token claims and still enforces the operation’s actor policy and scopes. Never put an organization id in a request body to switch tenants. Provisioning and credential rotation are separate from installing a client library. Store machine credentials server-side, request the least authority needed, and use the authentication flow provisioned for that specific service. Do not reuse a machine token for a person-delegated MCP connection. See Auth0’s organization machine-access documentation.