Bucket · Authentication Profile

Bucket Authentication

Authentication

Bucket secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyFeature FlagsFeature ManagementFeature FlaggingDeveloper ToolsSoftware-as-a-ServiceEntitlementsExperimentationMCPAgent Ready
Methods: http Schemes: 1 OAuth flows: API key in: header, query

Security Schemes

APIKey http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://docs.reflag.com/api/api-access + openapi/bucket-management-openapi-original.json
docs: https://docs.reflag.com/api/api-access
summary:
  types:
  - http
  api_key_in:
  - header
  - query
  oauth2_flows: []
  note: >-
    Bearer-token (API-key) auth across both APIs; no per-operation OAuth scopes in
    the spec. App login (not the API) uses OAuth 2.0 / OIDC via Clerk.
schemes:
- name: APIKey
  type: http
  scheme: bearer
  description: API key authentication, for service access (Management API)
  sources:
  - openapi/bucket-management-openapi-original.json
keys:
  runtime_api:
  - name: Publishable key
    usage: client-side (web/mobile/public apps)
    transport: Authorization Bearer, or ?publishableKey= query parameter
    scope: environment-specific; safe to expose; limited permissions
  - name: Secret key
    usage: server-side only
    transport: Authorization Bearer only
    scope: environment-specific; grants targeting definitions and secret flags
  management_api:
  - name: API key
    usage: server-side / CI-CD (e.g. Reflag CLI)
    transport: Authorization Bearer
    scope: app-scoped, usable across all environments; scoped permissions selected at creation
identity_provider:
  name: Clerk
  oauth_metadata: https://app.reflag.com/.well-known/oauth-authorization-server
  oidc_discovery: https://clerk.reflag.com/.well-known/openid-configuration
  note: OAuth 2.0 / OIDC for dashboard login, not for API access.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/bucket-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.