Clicktivated Authentication

generated: '2026-08-12'
method: probed
source: live probes of api.clicktivatedstudio.com and dashboard.clicktivatedstudio.com
description: >-
  Clicktivated publishes no authentication documentation, issues no public API
  credentials, and exposes no OAuth or OIDC metadata. The only authentication surface is
  the login on its customer dashboard, which sits behind a Cloudflare managed challenge.
  Nothing here is derived from a spec — there is no spec.

pointer_policy: >-
  NO type: Authentication pointer is emitted in apis.yml. That pointer is a scored
  assertion that the provider documents its authentication, and this artifact records
  the opposite — scheme_count is 0 and no auth documentation exists on any Clicktivated
  surface. The file is a measured absence, kept for auditability and cross-linked from
  conventions/clicktivated-conventions.yml.

schemes: []
scheme_count: 0
docs: null

findings:
- surface: graphql
  url: https://api.clicktivatedstudio.com/graphql
  auth_required: unknown
  observed: >-
    Anonymous requests reach the origin and are answered by Apollo's validation layer,
    not by an authentication layer — a syntactically invalid field returned a schema
    validation error rather than a 401 or 403. Whether individual fields are guarded
    cannot be determined without knowing a valid operation, and the schema is not
    readable.
  status: 400
- surface: graphql
  control: Apollo CSRF prevention
  detail: >-
    Requests must carry a non-simple Content-Type (e.g. application/json) or one of
    x-apollo-operation-name / apollo-require-preflight. This is a CSRF control, not
    authentication.
  status: 400
- surface: dashboard
  url: https://dashboard.clicktivatedstudio.com/login
  auth_required: true
  observed: >-
    A customer login exists but is fronted by a Cloudflare managed challenge, so the
    login mechanism itself was not observable.
  status: 403
- surface: player
  url: https://player.clicktivatedstudio.com/watch?v=707975ec4b
  auth_required: false
  observed: >-
    The embed player is fully anonymous. Access control is by possession of the opaque
    10-hex-character video hash — a bearer-URL model with no expiry, no signature and no
    revocation observable from outside.
  status: 200

federation_metadata:
  openid_configuration: 404
  oauth_authorization_server: 404
  oauth_protected_resource: 404
  hosts_checked:
  - clicktivated.com
  - api.clicktivatedstudio.com
  - player.clicktivatedstudio.com
  - dashboard.clicktivatedstudio.com
  note: See well-known/clicktivated-well-known.yml for the full probe matrix.

api_keys:
  issued_publicly: false
  note: >-
    No developer portal, no key-issuance flow, no key prefix convention, and no
    documentation of any credential. Clicktivated's own how-it-works page tells customers
    the product needs "no complex API setups".

checked: '2026-08-12'