Brevo Authentication

generated: '2026-08-13'
method: searched
source: https://developers.brevo.com/docs/authentication-schemes
docs:
- https://developers.brevo.com/docs/authentication-schemes
- https://developers.brevo.com/docs/api-key-authentication
- https://developers.brevo.com/docs/oauth
- https://developers.brevo.com/docs/oauth-scopes
- https://developers.brevo.com/docs/ip-security
description: >-
  Brevo offers two authentication schemes. API key is the default and the only one the
  published OpenAPI specs declare: a secret token sent in a lowercase `api-key` request
  header, scoped to the whole account with no per-key permissions. OAuth 2.0 was added for
  apps acting on behalf of a Brevo user and is where the granular permission model lives —
  37 scopes on a partner realm, created and managed entirely through the Brevo CLI with no
  application form or manual approval. The two are documented together but only one is
  described in the machine-readable contract, so an agent reading the specs alone will not
  discover OAuth at all.
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode, clientCredentials]
  default_scheme: apiKey
  spec_declared: [apiKey]
  docs_only: [oauth2]
schemes:
- name: api-key
  type: apiKey
  in: header
  parameter: api-key
  description: >-
    The API key is passed in the request headers as `api-key`. Generated in the Brevo
    dashboard at Account > SMTP & API > API keys; shown once at creation and not
    retrievable afterwards. There is no scope or permission model on an API key — it
    authorizes the full account surface.
  declared_in_spec: true
  sources:
  - openapi/brevo-email-api-openapi.yml
  - openapi/brevo-transactional-sms-openapi.yml
  - openapi/brevo-transactional-whatsapp-openapi.yml
  - openapi/brevo-marketing-campaigns-openapi.yml
  - openapi/brevo-contact-management-openapi.yml
  - openapi/brevo-events-openapi.yml
  - openapi/brevo-object-management-openapi.yml
  - openapi/brevo-accounts-and-settings-openapi.yml
  - openapi/brevo-sales-crm-openapi.yml
  - openapi/brevo-conversations-openapi.yml
  - openapi/brevo-ecommerce-openapi.yml
  - openapi/brevo-loyalty-openapi.yml
  - openapi/brevo-wallet-openapi.yml
  management_url: https://app.brevo.com/settings/keys/api
  verify_call: GET https://api.brevo.com/v3/account
- name: OAuth2
  type: oauth2
  description: >-
    Authorization-code (with PKCE) and client-credentials grants against the Brevo partner
    realm, for private integrations acting on behalf of a user. Apps are created, scoped
    and rotated with the Brevo CLI (`brevo app create` / `brevo app update --scope`).
    Distribution is `private` — there is no public app marketplace.
  declared_in_spec: false
  issuer: https://oauth.brevo.com/realms/partner
  discovery:
  - https://oauth.brevo.com/realms/partner/.well-known/oauth-authorization-server
  - https://oauth.brevo.com/realms/partner/.well-known/openid-configuration
  flows:
  - flow: authorizationCode
    authorizationUrl: https://oauth.brevo.com/realms/partner/oauth/authorize
    tokenUrl: https://oauth.brevo.com/realms/partner/oauth/token
    pkce: [plain, S256]
  - flow: clientCredentials
    tokenUrl: https://oauth.brevo.com/realms/partner/oauth/token
  refresh_token: true
  token_format: signed JWT with a space-separated `scope` claim
  introspection_endpoint: https://oauth.brevo.com/realms/partner/oauth/introspect
  revocation_endpoint: https://oauth.brevo.com/realms/partner/oauth/revoke
  userinfo_endpoint: https://oauth.brevo.com/realms/partner/oauth/userinfo
  jwks_uri: https://oauth.brevo.com/realms/partner/public-keys
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post]
  scope_count: 37
  scopes: scopes/brevo-scopes.yml
- name: MCP bearer token
  type: http
  scheme: bearer
  description: >-
    A distinct credential class for the hosted MCP server at mcp.brevo.com. Minted in the
    same API-keys screen with the "Create MCP server API key" toggle, sent as
    `Authorization: Bearer <token>`. Brevo's docs state it grants full read/write access to
    the account. The MCP endpoint additionally advertises its own OAuth authorization
    server with dynamic client registration and PKCE S256, scope `all`.
  declared_in_spec: false
  applies_to: https://mcp.brevo.com/v1/brevo/mcp
  discovery: https://mcp.brevo.com/.well-known/oauth-authorization-server
network_controls:
- name: IP allowlisting
  docs: https://developers.brevo.com/docs/ip-security
  description: >-
    Optional account-level control. When enabled, Brevo validates the source IP of every
    API request and blocks unauthorized IPs even when the API key is valid. Two modes:
    automatic authorization after security checks, or email notification requiring manual
    approval per new IP.