1000Satellitescoworking Authentication

generated: '2026-09-05'
method: probed
source: >-
  https://1000satellites.de/.well-known/oauth-authorization-server,
  https://1000satellites.de/.well-known/oauth-protected-resource, and live 200/401 responses observed on
  1000satellites.de/wp-json
description: >-
  1000 Satellites has two authentication postures on one host, and they are opposites. The wp/v2 content
  read surface is fully anonymous — ten resources return 200 with no credential — while the MCP server and
  every administrative WordPress route require a bearer token or a WordPress session. This artifact was
  probed rather than derived: the derived Content API declares no securitySchemes precisely because its
  documented operations need none, so a spec-only derivation would have recorded "no authentication" and
  missed the OAuth server entirely.
summary:
  types: [none, oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  anonymous_read: true
schemes:
- name: none
  type: none
  applies_to: openapi/1000satellitescoworking-content-api-openapi.yml
  description: >-
    The documented wp/v2 read operations require no credential. Verified anonymously on 2026-09-05:
    /wp/v2/posts, /pages, /media, /categories, /tags, /comments, /types, /taxonomies, /statuses and /search
    all returned HTTP 200.
  sources: [https://1000satellites.de/wp-json/wp/v2/posts]
- name: OAuth2
  type: oauth2
  applies_to: https://1000satellites.de/wp-json/mcp/mcp-oauth-server
  description: >-
    OAuth 2.1 authorization code with PKCE (S256), public clients, single `mcp` scope, bearer token in the
    Authorization header. The 401 challenge carries a WWW-Authenticate header pointing at the RFC 9728
    protected-resource document, which is the RFC 9728 discovery flow working as specified.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://1000satellites.de/oauth/authorize
    tokenUrl: https://1000satellites.de/oauth/token
    revocationUrl: https://1000satellites.de/oauth/revoke
    scopes: [mcp]
    pkce: S256
    token_endpoint_auth_methods_supported: [none]
    client_registration: >-
      No RFC 7591 dynamic client registration endpoint is advertised. The metadata sets
      client_id_metadata_document_supported true, so a client identifies itself with a client-ID metadata
      document URL rather than a pre-registered client_id.
  detail: scopes/1000satellitescoworking-scopes.yml
  sources: [https://1000satellites.de/.well-known/oauth-authorization-server]
- name: WordPressSession
  type: http
  scheme: cookie-or-basic
  applies_to: >-
    /wp/v2/users, /wp/v2/settings, /wp/v2/themes, /wp/v2/plugins, /wp/v2/menus, /wp/v2/block-types,
    /wp-abilities/v1/abilities and every write method on the wp/v2 routes
  description: >-
    Standard WordPress authentication — a logged-in cookie plus X-WP-Nonce, or Application Passwords over
    HTTP Basic. Anonymous requests to these routes return 401 rest_forbidden. Not documented by the
    provider; recorded from the observed 401s and from the Access-Control-Allow-Headers response header,
    which advertises Authorization and X-WP-Nonce.
  sources: [https://1000satellites.de/wp-json/wp/v2/users]
notes:
- >-
  No API key scheme of any kind exists on this provider. There is no developer portal, no key issuance
  page, and no sign-up flow that yields a credential — the sign-up surface on the site books workspace,
  not API access.
x-evidence:
  fetched: '2026-09-05'
  probes:
  - {url: 'https://1000satellites.de/wp-json/wp/v2/posts?per_page=1', status: 200}
  - {url: 'https://1000satellites.de/wp-json/wp/v2/users?per_page=1', status: 401}
  - {url: 'https://1000satellites.de/wp-json/wp-abilities/v1/abilities', status: 401}
  - {url: 'https://1000satellites.de/wp-json/mcp/mcp-oauth-server', method: POST tools/list, status: 401}
  - {url: 'https://1000satellites.de/.well-known/oauth-authorization-server', status: 200}