Elaichi OAuth discovery API
The OAuth discovery API from Elaichi — 3 operation(s) for oauth discovery.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/elaichi-ai:elaichi-ai-oauth-discovery-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Elaichi OAuth discovery API
version: 0.1.0
description: 'Control-plane HTTP API for Elaichi, the MCP control plane for SaaS teams. Authenticate with an organization API token (create one in the Elaichi app under Settings → API tokens) sent as a bearer token, plus the `X-Organization-Id` header on org-scoped routes; the MCP and OAuth endpoints use their own protocols. A few actions are deliberately not available to an API token and must be done by a person in the Elaichi app: managing API and SCIM tokens, creating an organization, approving an access request, deleting an organization, and changing the two-factor requirement. The operations concerned say so. Endpoints used only by the Elaichi app itself (sign-in, consent screens, browser redirects, inbound webhooks) are not documented.'
servers:
- url: https://api.elaichi.ai
description: Production
tags:
- name: OAuth discovery
paths:
/.well-known/oauth-protected-resource:
get:
operationId: getOAuthProtectedResourceMetadata
summary: Get protected resource metadata (RFC 9728)
tags:
- OAuth discovery
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
resource:
type: string
format: uri
description: Canonical resource identifier of the MCP endpoint — the RFC 8707 audience.
authorization_servers:
type: array
items:
type: string
format: uri
description: Issuers permitted to authorize access to this resource.
scopes_supported:
type: array
items:
type: string
enum:
- mcp:read
- mcp:write
- mcp:destructive
- mcp:tools
- openid
- email
bearer_methods_supported:
type: array
items:
type: string
description: Always `["header"]` — the token goes in `Authorization`, never in a query string.
resource_documentation:
type: string
format: uri
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: 'Describes the MCP endpoint and names the authorization server that protects it. Public, unauthenticated, and readable cross-origin from any origin by design (a wildcard, deliberately uncredentialed CORS policy) — an MCP client fetches it before it holds any credential, often from a browser context. Discovery starts here: an unauthenticated `POST /mcp` answers 401 with a `WWW-Authenticate` header whose `resource_metadata` parameter points at this document; follow `authorization_servers[0]` to `/.well-known/oauth-authorization-server` for the endpoint URLs. Cached for one hour.'
security: []
/.well-known/oauth-authorization-server:
get:
operationId: getOAuthAuthorizationServerMetadata
summary: Get authorization server metadata (RFC 8414)
tags:
- OAuth discovery
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
issuer:
type: string
format: uri
authorization_endpoint:
type: string
format: uri
token_endpoint:
type: string
format: uri
registration_endpoint:
type: string
format: uri
revocation_endpoint:
type: string
format: uri
response_types_supported:
type: array
items:
type: string
grant_types_supported:
type: array
items:
type: string
enum:
- authorization_code
- refresh_token
code_challenge_methods_supported:
type: array
items:
type: string
enum:
- S256
token_endpoint_auth_methods_supported:
type: array
items:
type: string
enum:
- none
- client_secret_post
- client_secret_basic
revocation_endpoint_auth_methods_supported:
type: array
items:
type: string
scopes_supported:
type: array
items:
type: string
enum:
- mcp:read
- mcp:write
- mcp:destructive
- mcp:tools
- openid
- email
service_documentation:
type: string
format: uri
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: 'Endpoint URLs and capabilities of the MCP authorization server. Public, unauthenticated and CORS-open on the same terms as the protected-resource document. `code_challenge_methods_supported: ["S256"]` is load-bearing: it is the only machine-readable statement that PKCE is mandatory and that `plain` will be rejected. Dynamic client registration (RFC 7591) is advertised; client-id metadata documents (CIMD) deliberately are not. Cached for one hour.'
security: []
/.well-known/openid-configuration:
get:
operationId: getOpenIdConfiguration
summary: Get the OpenID Connect discovery document
tags:
- OAuth discovery
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
issuer:
type: string
format: uri
authorization_endpoint:
type: string
format: uri
token_endpoint:
type: string
format: uri
userinfo_endpoint:
type: string
format: uri
registration_endpoint:
type: string
format: uri
revocation_endpoint:
type: string
format: uri
response_types_supported:
type: array
items:
type: string
grant_types_supported:
type: array
items:
type: string
enum:
- authorization_code
- refresh_token
subject_types_supported:
type: array
items:
type: string
enum:
- public
description: Always `["public"]` — the subject is the same `sub` for every client, never pairwise.
code_challenge_methods_supported:
type: array
items:
type: string
enum:
- S256
token_endpoint_auth_methods_supported:
type: array
items:
type: string
enum:
- none
- client_secret_post
- client_secret_basic
scopes_supported:
type: array
items:
type: string
enum:
- mcp:read
- mcp:write
- mcp:destructive
- mcp:tools
- openid
- email
claims_supported:
type: array
items:
type: string
enum:
- sub
- email
- email_verified
description: Exactly the claims `/oauth/userinfo` can return, and no more.
service_documentation:
type: string
format: uri
'400':
description: Bad request
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'404':
description: Not found
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: Rate limited
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: 'Turns this authorization server into an OpenID provider as far as a relying party is concerned — the control an OpenAI ChatGPT Business or Enterprise admin needs to restrict a connector to their own domain. It restates `/.well-known/oauth-authorization-server` rather than configuring a second server: same `issuer`, endpoints, `openid`/`email`-inclusive scope catalog and S256-only PKCE rule, so a client reading either document reaches the same server. Public, unauthenticated, CORS-open and cached for one hour on the same terms as the other two `.well-known` documents.
**Deliberately missing two members OIDC Discovery marks REQUIRED: `jwks_uri` and `id_token_signing_alg_values_supported`.** Both describe how to verify an ID token, and this server issues none — identity is read from `GET/POST /oauth/userinfo` instead, which OpenAI''s own documentation names as the mandatory half (the ID token is the alternative). An absent member fails honestly; a present and false one would not. `subject_types_supported: ["public"]` matches what `/oauth/userinfo` actually returns: the same subject to every client, never a pairwise identifier.'
security: []
components:
schemas:
Error:
type: object
required:
- error
description: The Elaichi error envelope. The MCP OAuth endpoints under `/oauth` are the exception — they return RFC 6749 errors instead (see `OAuthError`).
properties:
error:
type: object
required:
- message
- code
properties:
message:
type: string
description: Human-readable. 5xx messages are deliberately generic.
code:
type: string
description: Stable machine-readable code, e.g. `not_found`, `subscription_required`.
details:
description: Structured detail for codes that carry one, e.g. `toolboxes_need_resolution`.
feature:
type: string
description: The gated feature, on entitlement failures.
plan:
type:
- string
- 'null'
enum:
- personal
- gold
- black
- null
additionalProperties: true
securitySchemes:
bearerAuth:
type: http
scheme: bearer
bearerFormat: session or API token
description: '`Authorization: Bearer <token>` with an org-scoped API token (`elch_{org_id}_{64 hex}`), created in the Elaichi app under Settings → API tokens. The Elaichi app itself signs in with a session cookie, which is also accepted but is not meant for integrations. Two other credential families exist and are NOT interchangeable with this one: an MCP OAuth access token (`POST /mcp` only) and a SCIM token (`/scim/v2/*` only).'
mcpOAuth:
type: oauth2
description: MCP OAuth access token, used only by `POST /mcp` — not interchangeable with `bearerAuth`. Discovered per RFC 9728/8414 at `/.well-known/oauth-protected-resource` and `/.well-known/oauth-authorization-server`.
flows:
authorizationCode:
authorizationUrl: https://api.elaichi.ai/oauth/authorize
tokenUrl: https://api.elaichi.ai/oauth/token
scopes:
mcp:read: Anything you can already see in Elaichi. Never secret values. It can also ask an admin for access to something restricted for you.
mcp:write: Create and change teams, roles, toolboxes, templates and connections, and share access.
mcp:destructive: Permanently delete data and remove access in Elaichi. This cannot be undone.
mcp:tools: Run tools from the toolboxes you choose next, deleting in your connected apps included. It can also ask an admin for access to something restricted for you.
openid: That you are signed in, and the user ID we use for you. Nothing else.
email: Your email address, and whether it is verified. Apps use this to check your domain.