1Lookup Authentication

generated: '2026-08-14'
method: searched
source: https://app.1lookup.io/api
docs: https://app.1lookup.io/api
description: >-
  1Lookup runs two distinct authentication models: a static API key presented as an HTTP Bearer token on
  the REST API, and OAuth 2.1 (authorization code + PKCE, with dynamic client registration) on the hosted
  MCP connector. Derived by hand from the published reference and the live RFC 8414 / RFC 9728 metadata —
  the provider publishes no OpenAPI securitySchemes to derive from mechanically.
summary:
  types: [http, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
schemes:
  - name: bearerApiKey
    type: http
    scheme: bearer
    in: header
    header: Authorization
    format: 'Authorization: Bearer sk_live_…'
    key_prefix: sk_live_
    applies_to: https://app.1lookup.io/api/v1
    issued_from: 1Lookup dashboard (https://app.1lookup.io) — API keys section
    sources: [https://app.1lookup.io/api]
    notes:
      - >-
        All REST requests must carry a valid API key in the Authorization header. The reference is
        explicit that there are no other auth schemes and no unauthenticated access.
      - >-
        Keys belong to an ORGANIZATION, not a person, and carry that organization's full credit
        balance. Several keys can be held at once, so rotation is create-new, deploy, delete-old.
      - >-
        A paid plan is required: a key on a free-plan organization returns 403 UPGRADE_REQUIRED even
        when the account still has credits. Dashboard lookups are unaffected.
      - Docs advise environment-variable storage, no client-side exposure, and periodic rotation.
      - >-
        Enforcement scope split, corrected 2026-08-14: LOOKUP rate limits are applied PER KEY, while
        the credit balance and the account/monitoring limit are per organization.
      - 'Malformed JSON returns 400 INVALID_REQUEST; a missing or invalid key returns 401 UNAUTHORIZED.'
    required_headers:
      Authorization: 'Bearer sk_live_… (required)'
      Content-Type: 'application/json on every request with a body'
  - name: mcpOAuth21
    type: oauth2
    applies_to: https://app.1lookup.io/api/mcp
    flows:
      - flow: authorizationCode
        authorizationUrl: https://app.1lookup.io/api/mcp/oauth/authorize
        tokenUrl: https://app.1lookup.io/api/mcp/oauth/token
        registrationUrl: https://app.1lookup.io/api/mcp/oauth/register
        pkce: [S256]
        token_endpoint_auth_methods: [none]
        grant_types: [authorization_code, refresh_token]
        scopes:
          lookup: Access to the 1Lookup MCP tool set, billed to the authorizing account's plan credits
    sources:
      - well-known/1lookup-oauth-authorization-server.json
      - well-known/1lookup-oauth-protected-resource.json
    notes:
      - No API key changes hands; the MCP client receives a scoped, revocable token.
      - >-
        A paid plan is still required — a successful OAuth grant on a free-plan organization returns
        403 UPGRADE_REQUIRED on every tool call.
      - 'Discovery is also advertised at https://www.1lookup.io/.well-known/mcp/server-card.json.'
      - Bearer token is presented in the Authorization header (bearer_methods_supported = header).
      - Access can be revoked from the 1Lookup account at any time.
platform_controls:
  mfa: 'Multi-factor authentication (MFA) on the dashboard — https://www.1lookup.io/security'
  rbac: 'Role-based access control — https://www.1lookup.io/security'
  session: 'Secure JWT with refresh tokens — https://www.1lookup.io/security'
x-evidence:
  - url: https://app.1lookup.io/api
    http_status: 200
    fetched: '2026-08-14'
  - url: https://app.1lookup.io/.well-known/oauth-authorization-server
    http_status: 200
    fetched: '2026-08-14'
  - url: https://www.1lookup.io/.well-known/mcp/server-card.json
    http_status: 200
    fetched: '2026-08-14'
  - url: https://www.1lookup.io/security
    http_status: 200
    fetched: '2026-08-09'