Agorapulse Authentication

generated: '2026-08-13'
method: searched
source: openapi/_original/agorapulse-open-api-openapi.yml
docs: https://support.agorapulse.com/en/articles/12417183-how-to-connect-to-agorapulse-s-open-api
description: >-
  Agorapulse runs two independent authentication models. The REST API is a single static API key in
  an X-API-KEY header, scoped to the individual user who minted it. The remote MCP server is a
  separate OAuth 2.0 protected resource with its own authorization server, dynamic client
  registration and PKCE. They do not share credentials.
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
schemes:
- name: bearerAuth
  type: apiKey
  in: header
  parameter: X-API-KEY
  applies_to: All REST operations (declared as the document-level security requirement).
  description: >-
    Despite the scheme name, this is not a bearer token — it is a raw API key in an X-API-KEY header.
    Keys are minted per user at Personal settings -> API Keys and are shown once. Permissions are
    inherited from the user's own role, so the key of an org owner or manager is needed for full
    profile coverage. Requests without a valid key return 401.
  sources:
  - openapi/_original/agorapulse-open-api-openapi.yml
  - https://support.agorapulse.com/en/articles/12417183-how-to-connect-to-agorapulse-s-open-api
- name: HookSignature
  type: apiKey
  in: header
  parameter: X-Hook-Signature
  applies_to: Inbound webhook deliveries (PUBLISHING_POST, INBOX_ITEM).
  description: >-
    SHA256 HMAC of the raw request body, computed with the shared secret from the webhook
    subscription. Verified by the receiver, not sent by the caller.
  sources:
  - openapi/_original/agorapulse-open-api-openapi.yml
- name: MCP OAuth
  type: oauth2
  applies_to: The remote MCP server at https://api.openmcp.agorapulse.com/mcp
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.identity.agorapulse.com/oauth/authorize
    tokenUrl: https://api.identity.agorapulse.com/oauth/token
    userinfoUrl: https://api.identity.agorapulse.com/oauth/userinfo
    registrationUrl: https://api.identity.agorapulse.com/oauth/register
    scopes: [read]
    pkce: [S256]
    grant_types: [authorization_code, refresh_token]
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
    resource_parameter_supported: true
  sources:
  - well-known/agorapulse-oauth-authorization-server.json
  - well-known/agorapulse-oauth-protected-resource.json
key_management:
  mint: Avatar (bottom left) -> Personal settings -> API Keys -> Create new API keys
  visibility: Shown once at creation; not retrievable afterwards.
  scope: Per individual user; API permissions equal that user's in-app access level.
  plan_gate: >-
    The REST Reports Open API is documented as available on the Custom plan only. The MCP connector
    is documented as available on every plan except Legacy and Free — a different gate.
x-evidence:
- {fetched: '2026-08-13', url: 'https://api.agorapulse.com/v1.0/core/organizations', http_status: 401, body: '{"code":2,"message":"No valid API key found in request header X-API-Key"}'}
- {fetched: '2026-08-13', url: 'https://api.openmcp.agorapulse.com/.well-known/oauth-authorization-server', http_status: 200}