CARTO · Authentication Profile

Cartodb Authentication

Authentication

CARTO secures its APIs with apiKey, oauth2, and openIdConnect across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode and clientCredentials flow(s).

CompanyDeveloper ToolsLocation IntelligenceGeospatialMapsSpatial AnalyticsData WarehouseGISAgents

Methods: apiKey, oauth2, openIdConnect Schemes: 3 OAuth flows: authorizationCode, clientCredentials API key in: header, query

Security Schemes

API Access Token apiKey

· in: header ()

OAuth Access Token oauth2

· flows: authorizationCode, clientCredentials

OpenID Connect openIdConnect

Source

Authentication Profile

generated: '2026-07-18'
method: searched
source: https://docs.carto.com/carto-for-developers/key-concepts/authentication-methods
docs: https://docs.carto.com/carto-for-developers/key-concepts/authentication-methods
summary:
  types: [apiKey, oauth2, openIdConnect]
  api_key_in: [header, query]
  header: 'Authorization: Bearer <token>'
  oauth2_flows: [authorizationCode, clientCredentials]
  oauth2_audience: carto-cloud-native-api
  identity_provider: Auth0 (auth.carto.com)
schemes:
- name: API Access Token
  type: apiKey
  in: header
  description: >-
    Permanent, non-expiring token generated in the CARTO Workspace. Simple to
    generate, scoped/restrictive, and not tied to a specific user. Passed as a
    Bearer token in the Authorization header (also accepted as an access_token
    query parameter on some map/tile endpoints).
  docs: https://docs.carto.com/carto-for-developers/key-concepts/authentication-methods/api-access-tokens
- name: OAuth Access Token
  type: oauth2
  description: >-
    Short-lived (24h) OAuth 2.0 bearer token tied to a user's permissions,
    obtained through the Auth0-backed CARTO identity provider. Used for both
    user-to-machine (SPA) and machine-to-machine access to the Cloud-Native API.
  docs: https://docs.carto.com/carto-for-developers/key-concepts/authentication-methods/oauth-access-tokens
  audience: carto-cloud-native-api
  flows:
  - flow: authorizationCode
    grant: authorization_code
    authorizationUrl: https://auth.carto.com/authorize
    tokenUrl: https://auth.carto.com/oauth/token
    client_type: SPA (Single Page Application) OAuth client
  - flow: clientCredentials
    grant: client_credentials
    tokenUrl: https://auth.carto.com/oauth/token
    client_type: M2M (Machine-to-Machine) OAuth client
- name: OpenID Connect
  type: openIdConnect
  openIdConnectUrl: https://auth.carto.com/.well-known/openid-configuration
  description: >-
    Auth0 OIDC discovery for the CARTO identity provider; issuer
    https://auth.carto.com/. Standard OIDC scopes (openid, profile, email,
    offline_access) supported for user login and refresh tokens.
  sources: [well-known/cartodb-openid-configuration.json]

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/cartodb-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.