Brevo Authentication

generated: '2026-08-13'
method: searched
source: https://developers.brevo.com/docs/authentication-schemes
docs: https://developers.brevo.com/docs/authentication-schemes
description: 'Brevo offers two authentication schemes. API key is the default and the only one the published OpenAPI
  specs declare: a secret token sent in a lowercase `api-key` request header, scoped to the whole account with no
  per-key permissions. OAuth 2.0 was added for apps acting on behalf of a Brevo user and is where the granular permission
  model lives — 37 scopes on a partner realm, created and managed entirely through the Brevo CLI with no application
  form or manual approval. The two are documented together but only one is described in the machine-readable contract,
  so an agent reading the specs alone will not discover OAuth at all.'
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  default_scheme: apiKey
  spec_declared:
  - apiKey
  docs_only:
  - oauth2
schemes:
- name: api-key
  type: apiKey
  in: header
  parameter: api-key
  description: The API key is passed in the request headers as `api-key`. Generated in the Brevo dashboard at Account
    > SMTP & API > API keys; shown once at creation and not retrievable afterwards. There is no scope or permission
    model on an API key — it authorizes the full account surface.
  declared_in_spec: true
  sources:
  - openapi/brevo-email-api-openapi.yml
  - openapi/brevo-transactional-sms-openapi.yml
  - openapi/brevo-transactional-whatsapp-openapi.yml
  - openapi/brevo-marketing-campaigns-openapi.yml
  - openapi/brevo-contact-management-openapi.yml
  - openapi/brevo-events-openapi.yml
  - openapi/brevo-object-management-openapi.yml
  - openapi/brevo-accounts-and-settings-openapi.yml
  - openapi/brevo-sales-crm-openapi.yml
  - openapi/brevo-conversations-openapi.yml
  - openapi/brevo-ecommerce-openapi.yml
  - openapi/brevo-loyalty-openapi.yml
  - openapi/brevo-wallet-openapi.yml
  management_url: https://app.brevo.com/settings/keys/api
  verify_call: GET https://api.brevo.com/v3/account
- name: OAuth2
  type: oauth2
  description: Authorization-code (with PKCE) and client-credentials grants against the Brevo partner realm, for
    private integrations acting on behalf of a user. Apps are created, scoped and rotated with the Brevo CLI (`brevo
    app create` / `brevo app update --scope`). Distribution is `private` — there is no public app marketplace.
  declared_in_spec: false
  issuer: https://oauth.brevo.com/realms/partner
  discovery:
  - https://oauth.brevo.com/realms/partner/.well-known/oauth-authorization-server
  - https://oauth.brevo.com/realms/partner/.well-known/openid-configuration
  flows:
  - flow: authorizationCode
    authorizationUrl: https://oauth.brevo.com/realms/partner/oauth/authorize
    tokenUrl: https://oauth.brevo.com/realms/partner/oauth/token
    pkce:
    - plain
    - S256
  - flow: clientCredentials
    tokenUrl: https://oauth.brevo.com/realms/partner/oauth/token
  refresh_token: true
  token_format: signed JWT with a space-separated `scope` claim
  introspection_endpoint: https://oauth.brevo.com/realms/partner/oauth/introspect
  revocation_endpoint: https://oauth.brevo.com/realms/partner/oauth/revoke
  userinfo_endpoint: https://oauth.brevo.com/realms/partner/oauth/userinfo
  jwks_uri: https://oauth.brevo.com/realms/partner/public-keys
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  scope_count: 37
  scopes: scopes/brevo-scopes.yml
- name: MCP bearer token
  type: http
  scheme: bearer
  description: 'A distinct credential class for the hosted MCP server at mcp.brevo.com. Minted in the same API-keys
    screen with the "Create MCP server API key" toggle, sent as `Authorization: Bearer <token>`. Brevo''s docs state
    it grants full read/write access to the account. The MCP endpoint additionally advertises its own OAuth authorization
    server with dynamic client registration and PKCE S256, scope `all`.'
  declared_in_spec: false
  applies_to: https://mcp.brevo.com/v1/brevo/mcp
  discovery: https://mcp.brevo.com/.well-known/oauth-authorization-server
network_controls:
- name: IP allowlisting
  docs: https://developers.brevo.com/docs/ip-security
  description: 'Optional account-level control. When enabled, Brevo validates the source IP of every API request
    and blocks unauthorized IPs even when the API key is valid. Two modes: automatic authorization after security
    checks, or email notification requiring manual approval per new IP.'
docs_all:
- https://developers.brevo.com/docs/authentication-schemes
- https://developers.brevo.com/docs/api-key-authentication
- https://developers.brevo.com/docs/oauth
- https://developers.brevo.com/docs/oauth-scopes
- https://developers.brevo.com/docs/ip-security