11X Authentication

generated: '2026-08-05'
method: searched
source: https://11x.mintlify.app/integrations/mike-browser-implementation
docs: https://11x.mintlify.app/integrations/mike-browser-implementation
spec_derived: false
spec_note: >-
  derive-authentication.py was not run: there is no OpenAPI/Swagger in this repo and none is
  published by 11x, so there are no securitySchemes to aggregate. Everything below was read from
  11x's published documentation, not inferred.
summary:
  types: [apiKey, oauth2]
  api_key_in: [query]
  oauth2_flows: [authorizationCode]
  oauth2_delegated_to: Ampersand (third-party integration broker)
schemes:
- name: 11xApiKey
  type: apiKey
  in: query
  parameter: apikey
  description: >-
    An 11x key passed as the `apikey` query parameter when loading the PersonaClient browser
    script, and again to the PersonaClient constructor. This is the only 11x authentication
    mechanism observed in published documentation. Note it is a browser-side key embedded in
    page markup, so it is a publishable client-side identifier rather than a secret.
  surface: browser embed
  documented_example: 'script.src = "https://api.prod.centralus.az.sindarin.tech/PersonaClientPublicV2?apikey=<YOUR_11X_KEY>"'
  sources:
  - https://11x.mintlify.app/integrations/mike-browser-implementation
- name: CrmOAuth
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: null
    tokenUrl: null
  description: >-
    CRM connections (Salesforce, HubSpot, Zoho) are established over "a secure OAuth connection"
    brokered by Ampersand. The end user authorizes in-browser from the 11x integrations tab; 11x
    publishes no client credentials, endpoints, or scope list for this flow.
  broker: Ampersand
  providers: [salesforce, hubspot, zoho]
  sources:
  - https://11x.mintlify.app/integrations/mike-crm-integration
platform_api:
  documented: false
  note: >-
    The 11x Platform API marketed at /platform/integrations/api publishes no authentication
    documentation. api.11x.ai returns HTTP 403 to every anonymous request, including
    /.well-known/ paths, so no auth challenge, WWW-Authenticate header, or OAuth metadata could
    be observed.
unverified_claims:
- claim: 'Authorization: Bearer YOUR_API_KEY'
  source: https://11x.mintlify.app/.well-known/agent-skills/11x/skill.md
  verified: false
  note: >-
    Appears in 11x's published agent skill, but that document is machine-generated boilerplate
    that misdescribes 11x as an RPA platform and lists explicitly hypothetical endpoints. NOT
    treated as a verified 11x auth scheme.
x-evidence:
  fetched: '2026-08-05'
  probes:
  - {url: 'https://api.11x.ai/.well-known/openid-configuration', http_status: 403}
  - {url: 'https://api.11x.ai/.well-known/oauth-authorization-server', http_status: 403}
  - {url: 'https://www.11x.ai/.well-known/openid-configuration', http_status: 404}