Bonsai · Authentication Profile

Bonsai Authentication

Authentication

Bonsai's programmatic surface (its hosted MCP server) authenticates with OAuth 2.1 authorization-code flow using PKCE, driven by the AI client. There are no API keys to create or paste; on first call the user is directed to Bonsai to log in, approves in the browser, and the client receives a short-lived token (~15 minutes, auto-refreshed) that is passed through to Bonsai without being stored by the MCP server. Access is scoped to the user's existing Bonsai role.

Bonsai secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

CompanyB2BBusiness ManagementFreelancingAgenciesCRMProject ManagementTime TrackingInvoicingProposalsContractsAccountingMCP

Methods: oauth2 Schemes: 1 OAuth flows: authorizationCode API key in:

Security Schemes

oauth2-pkce oauth2

· flows: authorizationCode

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: https://docs.hellobonsai.com/
docs: https://docs.hellobonsai.com/
description: >-
  Bonsai's programmatic surface (its hosted MCP server) authenticates with
  OAuth 2.1 authorization-code flow using PKCE, driven by the AI client. There
  are no API keys to create or paste; on first call the user is directed to Bonsai
  to log in, approves in the browser, and the client receives a short-lived token
  (~15 minutes, auto-refreshed) that is passed through to Bonsai without being
  stored by the MCP server. Access is scoped to the user's existing Bonsai role.
summary:
  types:
  - oauth2
  oauth2_flows:
  - authorizationCode
schemes:
- name: oauth2-pkce
  type: oauth2
  flows:
  - flow: authorizationCode
    pkce: true
    token_ttl_seconds: 900
    description: >-
      OAuth 2.1 authorization-code flow with PKCE, brokered by the AI client
      against Bonsai; MCP server passes the bearer token through without storage.
  sources:
  - https://docs.hellobonsai.com/
  - mcp/bonsai-mcp.yml