6Sense Insights Authentication

generated: '2026-08-13'
method: searched
source: >-
  https://api.6sense.com/docs/ (Get your API Token / Headers sections) and
  https://api.6sense.com/.well-known/oauth-authorization-server (probed live).
description: >-
  6sense runs two distinct authentication surfaces. The REST APIs
  (api.6sense.com, epsilon.6sense.com, scribe.6sense.com) use a customer-issued
  API token in an `Authorization: Token <api_token>` header — note the `Token`
  scheme, not `Bearer`. The MCP server at https://api.6sense.com/mcp is a
  separate OAuth 2.0 protected resource with per-user authorization, dynamic
  client registration and the single scope `mcp:use`.

schemes:
  - id: api_token
    type: apiKey
    in: header
    name: Authorization
    scheme_prefix: 'Token '
    example: 'Authorization: Token <api_token>'
    applies_to:
      - Company Identification API
      - Company Firmographics API
      - Lead Scoring API
      - Lead Scoring and Firmographics API
      - People Enrichment API
      - People Search API
    key_format: 40-character randomly generated alphanumeric string
    issuance: >-
      Self-service in the 6sense Platform under Settings > API Token management
      > Generate New API token, scoped by API group. Tokens can only be
      generated for API groups covered by the customer's purchased credit type.
      Segments API tokens must be requested from 6sense support.
    provider_guidance:
      - Name each token after the integration it is used by.
      - Do not reuse one token across multiple integrations.
      - Rotate API tokens every 90 days.
      - Deactivate unused tokens and delete tokens no longer planned for use.
      - >-
        Enrichment API tokens must never be exposed on a public domain — those
        APIs are designed for server-to-server calls only.
      - >-
        Token settings (Score and Segments Settings) are secure by default and
        return no detailed information until explicitly widened.
    docs: https://api.6sense.com/docs/#get-your-api-token

  - id: partner_custom_id
    type: apiKey
    in: header
    name: X-6s-CustomID
    required: false
    description: >-
      Additional header partners must send for customer data identification.
      Format `<partner_name>-<customer_name>-<customer_api_token>` when calling
      on behalf of a customer, or `<partner_name>-<partner_api_token>` when
      calling with the partner's own token.
    docs: https://api.6sense.com/docs/

  - id: mcp_oauth2
    type: oauth2
    applies_to:
      - 6sense MCP server (https://api.6sense.com/mcp)
    flows:
      authorization_code:
        authorization_url: >-
          https://auth.6sense.com/oauth2/v1/apps/agentic/P32lusHUPY06hG8MJtqJnKEmq7hJ/MS3CTIZ4l7VZ4pFeraAIy18Y6wIVN/authorize
        token_url: >-
          https://auth.6sense.com/oauth2/v1/apps/agentic/P32lusHUPY06hG8MJtqJnKEmq7hJ/MS3CTIZ4l7VZ4pFeraAIy18Y6wIVN/token
        scopes:
          mcp:use: Read-only access to 6sense data through the MCP server.
      client_credentials:
        token_url: >-
          https://auth.6sense.com/oauth2/v1/apps/agentic/P32lusHUPY06hG8MJtqJnKEmq7hJ/MS3CTIZ4l7VZ4pFeraAIy18Y6wIVN/token
    issuer: >-
      https://auth.6sense.com/v1/apps/agentic/P32lusHUPY06hG8MJtqJnKEmq7hJ/MS3CTIZ4l7VZ4pFeraAIy18Y6wIVN
    jwks_uri: https://auth.6sense.com/P32lusHUPY06hG8MJtqJnKEmq7hJ/.well-known/jwks.json
    registration_endpoint: >-
      https://auth.6sense.com/v1/mgmt/mcp/client/P32lusHUPY06hG8MJtqJnKEmq7hJ/MS3CTIZ4l7VZ4pFeraAIy18Y6wIVN/register
    revocation_endpoint: https://auth.6sense.com/oauth2/v1/apps/P32lusHUPY06hG8MJtqJnKEmq7hJ/revoke
    userinfo_endpoint: https://auth.6sense.com/oauth2/v1/apps/P32lusHUPY06hG8MJtqJnKEmq7hJ/userinfo
    grant_types_supported:
      - authorization_code
      - refresh_token
      - client_credentials
      - urn:openid:params:grant-type:ciba
      - urn:ietf:params:oauth:grant-type:jwt-bearer
      - urn:ietf:params:oauth:grant-type:token-exchange
    code_challenge_methods_supported: [S256]
    token_endpoint_auth_methods_supported: [none, client_secret_basic, client_secret_post]
    dpop_supported: true
    dynamic_client_registration: true
    per_user_authorization: true
    detail: well-known/6sense-insights-oauth-authorization-server.json

unauthenticated_surface:
  - >-
    The Company Identification API can be invoked client-side through the
    6sense WebTag without the customer creating an API token; the WebTag carries
    its own configuration. Direct (non-WebTag) use of that API does require a
    token.

failure_response:
  status: 401
  body: >-
    Your API token is invalid or auth token is invalid or missing authorization
    header.
  detail: errors/6sense-insights-problem-types.yml