Archera · Authentication Profile

Archera Authentication

Authentication

The Archera Public API supports two authentication mechanisms: a static API key sent in the x-api-key header, and OAuth 2.0 Authorization Code with PKCE (also used by the hosted MCP server, with Dynamic Client Registration).

Archera secures its APIs with apiKey and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

CompanyDeveloper ToolsFinOpsCloud Cost ManagementCloud CommitmentsCost OptimizationMCPAzureGoogle Cloud
Methods: apiKey, oauth2 Schemes: 2 OAuth flows: authorizationCode API key in: header

Security Schemes

apiKey apiKey
· in: header ()
oauth2 oauth2
· flows: authorizationCode

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: >-
  https://docs.archera.ai/api-reference/public-api/api-key-access and
  https://api.archera.ai/.well-known/oauth-authorization-server — the Archera
  OpenAPI does not declare securitySchemes, so this profile is captured from the
  published auth docs and live OAuth authorization-server metadata.
docs: https://docs.archera.ai/api-reference/public-api/api-key-access
description: >-
  The Archera Public API supports two authentication mechanisms: a static API
  key sent in the x-api-key header, and OAuth 2.0 Authorization Code with PKCE
  (also used by the hosted MCP server, with Dynamic Client Registration).
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
schemes:
- name: apiKey
  type: apiKey
  in: header
  parameter_name: x-api-key
  description: >-
    Create an API key in the Archera web app under User Settings > API Access.
    Send it as the x-api-key request header. Requests are also scoped by an
    org_id path/query value obtained from User Settings > Organization.
  example: "curl -H 'x-api-key: YOUR_API_KEY' https://api.archera.ai/v1/org/{org_id}/metrics?provider=aws"
  docs: https://docs.archera.ai/api-reference/public-api/api-key-access
- name: oauth2
  type: oauth2
  description: >-
    OAuth 2.0 Authorization Code flow with PKCE (S256). Supports Dynamic Client
    Registration; token_endpoint_auth_methods_supported = none (public clients).
    This is the flow the hosted MCP server at https://mcp.archera.ai/mcp uses.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.archera.ai/oauth/authorize
    tokenUrl: https://api.archera.ai/oauth/token
    revocationUrl: https://api.archera.ai/oauth/revoke
    registrationUrl: https://api.archera.ai/oauth/register
    refreshSupported: true
    pkce: [S256]
    scopes:
    - archera:read
    - archera:write
    - archera:admin
    - archera:analytics
  metadata: well-known/archera-oauth-authorization-server.json
  jwks: well-known/archera-jwks.json
  docs: https://docs.archera.ai/api-reference/public-api/oauth