Cloutjam Authentication

generated: '2026-08-13'
method: searched
source: https://www.cloutdesk.com/agent-platform
sources:
- https://www.cloutdesk.com/agent-platform
- https://github.com/cloutdesk/agents/blob/main/README.md
status: beta
notes: >-
  UPGRADE over the 2026-07-18 round. No OpenAPI securitySchemes exist to derive from —
  Cloutdesk publishes no spec — so this profile is searched from the vendor's Agent
  Platform page and, new this round, from its own public agents repo, which names the
  environment variables an integrator sets (`CLOUTDESK_API_URL`, `CLOUTDESK_AGENT_PAT`)
  and states that the PAT is minted from the Cloutdesk dashboard. The OAuth grant is now
  specified more precisely than before: OAuth 2.1 + PKCE for the Claude Managed Agents
  one-click install. No authorization or token endpoint URL is published anywhere, and
  api.cloutdesk.com does not resolve, so no endpoint could be probed or recorded.
summary:
  types: [http, oauth2]
  http_bearer: true
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
  oauth2_pkce: true
  scope_gated: true
  scope_count: 4
  mtls: false
  openid_connect: false
schemes:
- name: personalAccessToken
  type: http
  scheme: bearer
  in: header
  header: Authorization
  bearer_prefix: cd_pat_
  example: 'Authorization: Bearer cd_pat_…'
  audience: power users, scripted/CLI workflows, agent runtimes
  minted_from: https://dashboard.cloutdesk.com
  env_var: CLOUTDESK_AGENT_PAT
  scoped: true
  scope_note: The repo states "Required scopes on the integrator's Cloutdesk PAT", so PATs carry the
    same scope names as OAuth grants.
  sources:
  - https://www.cloutdesk.com/agent-platform
  - https://github.com/cloutdesk/agents/blob/main/README.md
- name: oauth2
  type: oauth2
  flow: authorizationCode
  pkce: true
  version: OAuth 2.1
  audience: organization-wide installs; Claude Managed Agents one-click install
  authorizationUrl: null
  tokenUrl: null
  endpoints_published: false
  scopes_documented: [collaborations:read, creators:read, events:emit, transactions:read]
  scopes_marketing_example: [campaigns, collaborations, 'agreements:write']
  cli_login: npx @cloutdesk/mcp oauth login
  sources:
  - https://www.cloutdesk.com/agent-platform
  - https://github.com/cloutdesk/agents
per_surface:
- surface: MCP server
  auth: OAuth (login via `npx @cloutdesk/mcp oauth login`) or PAT via CLOUTDESK_AGENT_PAT
- surface: REST API (v1)
  auth: Bearer PAT (cd_pat_) or OAuth for org-wide installs
- surface: CLI (cloutdesk)
  auth: PAT
- surface: Microsoft 365 Copilot Studio / Workforce Agents
  auth: 'described as "Entra ID-friendly authentication"; no detail published'
authorization_model:
  row_level_security: true
  rls_detail: 'Agents operate under "the same row-level permissions as a human teammate";
    the platform is described as RLS-enforced.'
  granular_consent: true
  sensitive_actions_separately_consented: [e-signature, email send, creator ingest]
  audited: true
  source: https://www.cloutdesk.com/agent-platform
discovery:
  well_known_oauth_authorization_server: 404
  well_known_openid_configuration: 404
  probed: '2026-08-13'
  note: Neither RFC 8414 nor OIDC discovery is served on www.cloutdesk.com; see
    well-known/cloutjam-well-known.yml.
gaps:
- No authorization/token endpoint URLs published.
- No token lifetime, refresh, or rotation policy published.
- No dedicated authentication docs page; everything above comes from a marketing page and a
  skills repo README.
cross_links:
  scopes: scopes/cloutjam-scopes.yml
  conventions: conventions/cloutjam-conventions.yml
  mcp: mcp/cloutjam-mcp.yml
  well_known: well-known/cloutjam-well-known.yml