Archestra Authentication

generated: '2026-10-16'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://archestra.ai/docs/mcp/authentication
sources:
- https://archestra.ai/docs/mcp/authentication
- https://archestra.ai/docs/llm-proxy/authentication
- https://archestra.ai/docs/contributing/developer-quickstart
description: Authentication methods for Archestra AI as documented on the MCP Authentication, LLM Proxy Authentication, and Developer Quickstart
  pages.
schemes:
- type: apiKey
  name: Standard Virtual Key
  evidence: 'Use the key wherever the app expects a provider API key:'
  location: header
  header: Authorization
  how_to_obtain: Create a standard virtual key in the LLM Proxy UI, copy the key (shown only once), and include it as a Bearer token in the Authorization
    header.
- type: apiKey
  name: Passthrough Virtual Key
  evidence: 'Send it in X-Archestra-Virtual-Key , next to the provider''s own credential:'
  location: header
  header: X-Archestra-Virtual-Key
  how_to_obtain: Create a passthrough virtual key in the LLM Proxy UI, copy the key, and include it in the X-Archestra-Virtual-Key header.
- type: oauth2
  name: OAuth Client (client_credentials)
  evidence: Get a token. It lasts one hour.
  token_url: https://<archestra-host>/api/auth/oauth2/token
  scopes:
  - llm:proxy
  how_to_obtain: Create an OAuth client in Settings → OAuth Clients, then request a token via POST to the token URL with grant_type=client_credentials,
    client_id, client_secret, and scope.
- type: oauth2
  name: OAuth Client (authorization_code)
  evidence: Run the authorization code flow with PKCE. Ask for scope=llm:proxy . Add offline_access to get a refresh token.
  scopes:
  - llm:proxy
  - offline_access
  how_to_obtain: Configure redirect URIs for the OAuth client, then perform the standard OAuth 2.0 authorization code flow with PKCE to obtain
    an access token.
- type: http-bearer
  name: Identity Provider JWT
  evidence: 'Send the JWT as Authorization: Bearer on a provider route.'
  location: header
  header: Authorization
  how_to_obtain: Add an OIDC provider under Settings → Identity Providers, then use the issued JWT as a Bearer token in the Authorization header.
docs: https://archestra.ai/docs/mcp/authentication