Clearslide Authentication

generated: '2026-08-13'
method: searched
source: >-
  https://docs.platform.clearslide.com/oauth2.html, https://developer.clearslide.com/docs/oauth-20,
  https://developer.clearslide.com/docs/scim-at-clearslide,
  openapi/_original/clearslide-platform-api-swagger.json, and live probes of
  oauth.platform.clearslide.com and platform.clearslide.com
docs: https://developer.clearslide.com/docs/oauth-20
registration: mailto:apisupport@clearslide.com
summary:
  types:
  - oauth2
  oauth2_flows:
  - authorizationCode
  - refreshToken
  token_transport: custom-header
  token_format: opaque UUID
schemes:
- name: oauth2
  type: oauth2
  authorization_server: https://oauth.platform.clearslide.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://oauth.platform.clearslide.com/oauth/authorize
    tokenUrl: https://oauth.platform.clearslide.com/oauth/token
    request_params: [client_id, redirect_uri, response_type=code, state]
    scopes: [read, write]
  - flow: refreshToken
    tokenUrl: https://oauth.platform.clearslide.com/oauth/token
    grant_type: refresh_token
    scopes: [read, write]
  client_authentication:
    method: http-basic
    spec: RFC 2617 §2
    detail: client id and client secret base64-encoded in the Authorization header at the token endpoint.
  token_request_body: application/x-www-form-urlencoded or application/json
  token_response:
    fields: [access_token, token_type, refresh_token, Expires_in, scope]
    token_type: bearer
    expires_in_seconds: 3600
    note: >-
      The documented response field is capitalised `Expires_in`, not the RFC 6749 `expires_in`.
      Recorded as published.
  description: >-
    ClearSlide supports the OAuth 2.0 Authorization Code grant (RFC 6749 §4.1) and refresh_token
    grant. There is no self-service app registration: a partner emails apisupport@clearslide.com
    with a client redirect URL and is issued a client id and client secret by hand.
  sources:
  - https://docs.platform.clearslide.com/oauth2.html
  - https://developer.clearslide.com/docs/oauth-20
token_usage:
- surface: Platform API
  host: https://platform.clearslide.com
  header: authorizationToken
  value: the raw access token
  bearer_prefix: false
  rfc6750: false
  required: true
  evidence: >-
    Every one of the six operations in the published Swagger document declares a REQUIRED header
    parameter named `authorizationToken` with the description "OAuth2.0 Token".
  correction: >-
    The prior round of this artifact implied a standard `Authorization: Bearer` header. That is
    wrong for the Platform API and is corrected here.
- surface: SCIM API
  host: https://platform.clearslide.com/v2
  header: authorization
  value: the access token, shown both bare and with a `Bearer ` prefix in the docs
  rfc6750: partial
  evidence: >-
    The SCIM documentation shows `authorization: xxxxxxxxxxxxxxx` in one example and
    `-H "authorization:Bearer xxxx"` in a curl example on the same page.
  note: Two auth header conventions coexist on one host; the SCIM docs are internally inconsistent about the Bearer prefix.
impersonation:
  header: targetUserId
  required: true
  applies_to: [GET /presentations, GET /insights, POST /upload]
  description: >-
    A required header naming the user on whose behalf the call operates. Authorisation is
    therefore a function of the token AND this header, and the contract does not state what
    constrains which users a given token may target.
scopes:
  values: [read, write]
  granularity: coarse
  cross_ref: scopes/clearslide-scopes.yml
  note: >-
    Two scopes for the entire platform, including SCIM user and group provisioning. There is no
    scope separating directory administration from content read.
discovery:
  oauth_authorization_server_metadata: false
  openid_configuration: false
  evidence: >-
    /.well-known/oauth-authorization-server and /.well-known/openid-configuration return 404 on
    every ClearSlide host. Endpoints are only discoverable from prose documentation.
runtime_evidence:
  method: probed
  observations:
  - url: https://oauth.platform.clearslide.com/oauth/token
    method: POST
    status: 401
    www_authenticate: Basic realm="oauth2/client"
    server: Apache-Coyote/1.1
    body_shape: '{timestamp, status, error, message, path}'
    note: Spring Security OAuth authorization server.
  - url: https://platform.clearslide.com/presentations
    method: GET
    status: 401
    body: '{"message":"Unauthorized"}'
    headers: {x-amzn-errortype: UnauthorizedException}
    note: AWS API Gateway rejects unauthenticated calls at the edge before ClearSlide code runs.
gaps:
- The published contract declares no securityDefinitions, so no generated client can discover the auth model.
- No PKCE (RFC 7636) is documented for the authorization code flow.
- No token revocation (RFC 7009) or introspection (RFC 7662) endpoint is documented.
- Onboarding is manual and human-gated, so no agent can obtain credentials programmatically.