ChromaCode · Authentication Profile

Chromacode Authentication

Authentication

ChromaCode secures its APIs with openIdConnect, oauth2, and mutualTLS across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, implicit, clientCredentials, password, deviceCode, and ciba flow(s).

CompanyMolecular DiagnosticsGenomicsOncologyPCRLife SciencesHealthcareBioinformaticsClinical DiagnosticsCloud Software
Methods: openIdConnect, oauth2, mutualTLS Schemes: 2 OAuth flows: authorizationCode, implicit, clientCredentials, password, deviceCode, ciba API key in:

Security Schemes

ChromaCodeCloudOIDC openIdConnect
ChromaCodeCloudUserRealmOIDC openIdConnect

Source

Authentication Profile

chromacode-authentication.yml Raw ↑ 
generated: '2026-08-02'
method: searched
source: https://openid.chromacodecloud.com/auth/realms/apps/.well-known/openid-configuration
docs: https://www.chromacode.com/chromacode-cloud/
note: >-
  ChromaCode publishes no OpenAPI definition and no developer authentication guide,
  so this profile is built from the provider's own publicly readable OpenID Connect
  discovery documents plus the unauthenticated ChromaCode Cloud runtime config at
  https://chromacodecloud.com/config, and confirmed against the observed HTTP 401
  responses on every https://chromacodecloud.com/api/* path.
summary:
  types:
  - openIdConnect
  - oauth2
  - mutualTLS
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  - implicit
  - clientCredentials
  - password
  - deviceCode
  - ciba
  identity_provider: Keycloak
  public_api_key_program: false
schemes:
- name: ChromaCodeCloudOIDC
  type: openIdConnect
  openIdConnectUrl: https://openid.chromacodecloud.com/auth/realms/apps/.well-known/openid-configuration
  issuer: https://openid.chromacodecloud.com/auth/realms/apps
  realm: apps
  description: >-
    Primary realm used by the ChromaCode Cloud browser application. The public
    client "production-frontend" performs authorization_code with PKCE (check-sso
    on load) against this realm, brokered to the "production-idp" identity provider.
  sources:
  - well-known/chromacode-openid-configuration-apps.json
  endpoints:
    authorization: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/auth
    token: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/token
    userinfo: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/userinfo
    jwks: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/certs
    introspection: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/token/introspect
    revocation: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/revoke
    end_session: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/logout
    registration: https://openid.chromacodecloud.com/auth/realms/apps/clients-registrations/openid-connect
    device_authorization: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/auth/device
    pushed_authorization_request: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/ext/par/request
    backchannel_authentication: https://openid.chromacodecloud.com/auth/realms/apps/protocol/openid-connect/ext/ciba/auth
  grant_types:
  - authorization_code
  - implicit
  - refresh_token
  - password
  - client_credentials
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:openid:params:grant-type:ciba
  pkce_methods:
  - plain
  - S256
  token_endpoint_auth_methods:
  - private_key_jwt
  - client_secret_basic
  - client_secret_post
  - tls_client_auth
  - client_secret_jwt
  id_token_signing_algs:
  - RS256
  - RS384
  - RS512
  - PS256
  - PS384
  - PS512
  - ES256
  - ES384
  - ES512
  - HS256
  - HS384
  - HS512
  mtls_bound_access_tokens: true
  require_pushed_authorization_requests: false
  backchannel_logout_supported: true
  frontchannel_logout_supported: true
- name: ChromaCodeCloudUserRealmOIDC
  type: openIdConnect
  openIdConnectUrl: https://openid.chromacodecloud.com/auth/realms/cloud/.well-known/openid-configuration
  issuer: https://openid.chromacodecloud.com/auth/realms/cloud
  realm: cloud
  description: >-
    Secondary "cloud" user realm referenced as userRealm by the ChromaCode Cloud
    runtime config. Same Keycloak capability set as the apps realm but without the
    chromacloud application scopes.
  sources:
  - well-known/chromacode-openid-configuration-cloud.json
  endpoints:
    authorization: https://openid.chromacodecloud.com/auth/realms/cloud/protocol/openid-connect/auth
    token: https://openid.chromacodecloud.com/auth/realms/cloud/protocol/openid-connect/token
    userinfo: https://openid.chromacodecloud.com/auth/realms/cloud/protocol/openid-connect/userinfo
    jwks: https://openid.chromacodecloud.com/auth/realms/cloud/protocol/openid-connect/certs
client:
  id: production-frontend
  public_client: true
  on_load: check-sso
  idp_hint: production-idp
  redirect_uri: https://production.chromacodecloud.com
  ssl_required: external
  verify_token_audience: true
  source: https://chromacodecloud.com/config
observed:
- url: https://chromacodecloud.com/api/instrument
  status: 401
  body: '{"message":"Authorization not present on request.","error":{"name":"UnauthorizedError"}}'
- url: https://chromacodecloud.com/api/configuration/siteBanners
  status: 401
  body: '{"message":"Authorization not present on request.","error":{"name":"UnauthorizedError"}}'
x-evidence:
  fetched: '2026-08-02'
  urls:
  - https://openid.chromacodecloud.com/auth/realms/apps/.well-known/openid-configuration
  - https://openid.chromacodecloud.com/auth/realms/cloud/.well-known/openid-configuration
  - https://chromacodecloud.com/config
  http_status: 200

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/chromacode-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.