Benchmark Minerals Authentication

generated: '2026-09-04'
method: searched
source: https://www.benchmarkminerals.com/prices-api.yml + https://www.benchmarkminerals.com/api + https://mcp.benchmarkminerals.com/.well-known/oauth-protected-resource
docs: https://www.benchmarkminerals.com/api
provider: Benchmark Minerals
providerId: benchmark-minerals
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  surfaces: 2
  note: Two independent auth models on two independent surfaces; a credential for one does not work on
    the other.
schemes:
- name: api_key
  type: apiKey
  in: header
  parameter: x-api-key
  surface: Prices REST API
  base: https://api.benchmarkminerals.com/v2
  applies_to: all 36 operations
  provisioning: 'Self-service for existing subscribers only: "Your API key is available in the subscription
    section of your account. Simply log in to securely retrieve your API key" — https://www.benchmarkminerals.com/api.
    There is no public sign-up for an API key; a Benchmark subscription is a prerequisite.'
  rotation:
    documented: false
  statement: 'info.description: "Access to our API is secured using an API key. Users must include their
    unique API key in the request header x-api-key to authenticate their requests."'
  sources:
  - openapi/benchmark-minerals-prices-api.yml
  - https://www.benchmarkminerals.com/api
  observed:
    url: https://api.benchmarkminerals.com/v2
    unauthenticated_status: 403
    body: '{"message":"Forbidden"}'
    note: AWS API Gateway rejects an unkeyed request at the edge with no discovery surface behind it.
- name: mcp_oauth
  type: oauth2
  flow: bearer token
  surface: MCP gateway
  endpoint: https://mcp.benchmarkminerals.com/mcp
  issuer: https://cognito-idp.eu-west-2.amazonaws.com/eu-west-2_GuiZRnNNK
  authorization_endpoint: https://mcp-auth.benchmarkminerals.com/oauth2/authorize
  token_endpoint: https://mcp-auth.benchmarkminerals.com/oauth2/token
  revocation_endpoint: https://mcp-auth.benchmarkminerals.com/oauth2/revoke
  userinfo_endpoint: https://mcp-auth.benchmarkminerals.com/oauth2/userInfo
  jwks_uri: https://cognito-idp.eu-west-2.amazonaws.com/eu-west-2_GuiZRnNNK/.well-known/jwks.json
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  response_types:
  - code
  - token
  signing_alg:
  - RS256
  scopes:
  - benchmark-tools/sandbox.read
  - benchmark-tools/production.read
  provisioning:
    documented: false
    note: No public page explains how to obtain an MCP client_id/client_secret; the surface is undocumented.
  sources:
  - https://mcp.benchmarkminerals.com/.well-known/oauth-protected-resource
  - well-known/benchmark-minerals-cognito-openid-configuration.json
gaps:
- issue: no auth error schema
  impact: 401 and 403 are declared with a description only; an agent cannot machine-read whether a failure
    is a bad key or an unentitled market
- issue: no documented key rotation or expiry
  impact: long-lived agent credentials have no published lifecycle
- issue: the OAuth surface is undocumented
  impact: the only way to learn the MCP auth model is to probe the gateway
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com