Clozd Authentication

generated: '2026-08-04'
method: searched
source: >-
  openapi/clozd-data-api-v1-openapi.yml, openapi/clozd-data-api-v2-openapi.yml,
  openapi/clozd-data-api-v3-openapi.yml, https://oauth.clozd.com/.well-known/oauth-authorization-server
docs:
- https://help.clozd.com/hc/en-us/articles/9948957669659-API-Imports-Exports
- https://help.clozd.com/hc/en-us/articles/49656607624987-Connecting-to-Clozd-via-MCP
- https://help.clozd.com/hc/en-us/articles/45409542002587-Single-Sign-On-SSO
summary:
  types:
  - apiKey
  - oauth2
  - openIdConnect
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - refreshToken
  note: >-
    Two distinct auth models by surface. The REST Data API uses a long-lived organization API token in the
    x-api-token header. The MCP server uses OAuth 2.0 authorization code + PKCE against oauth.clozd.com,
    which brokers to the customer's own identity provider — no key material is stored in client config.
schemes:
- name: apiKey
  type: apiKey
  in: header
  parameter: x-api-token
  applies_to:
  - Clozd Data API v1.0
  - Clozd Data API v2.0
  - Clozd Data API v3.0
  sources:
  - openapi/clozd-data-api-v1-openapi.yml
  - openapi/clozd-data-api-v2-openapi.yml
  - openapi/clozd-data-api-v3-openapi.yml
  provisioning:
    docs: https://help.clozd.com/hc/en-us/articles/9948957669659-API-Imports-Exports
    self_serve: false
    steps:
    - Ask a Clozd Program Manager or support@clozd.com to enable the API Imports setting for the organization.
    - In the Clozd app, open the user menu (initials, top-right) and choose Settings.
    - Scroll to the API Token section, where the Organization ID and each Program ID are shown.
    - Click Create Access Token, name it, and confirm.
    scope: organization
    display_once: true
    display_once_note: >-
      The access token is shown exactly once at creation; if lost a new token must be created. Clozd
      documents no token rotation schedule, no expiry, and no revocation API.
    rotation_policy: not-published
    expiry: not-published
- name: oauth2
  type: oauth2
  applies_to:
  - Clozd MCP Server
  issuer: https://oauth.clozd.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://oauth.clozd.com/authorize
    tokenUrl: https://oauth.clozd.com/token
    pkce_methods:
    - S256
    scopes:
    - openid
    - profile
    - email
    - offline_access
    - api
  - flow: clientCredentials
    tokenUrl: https://oauth.clozd.com/token
  - flow: refreshToken
    tokenUrl: https://oauth.clozd.com/token
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - none
  dynamic_client_registration: https://oauth.clozd.com/register
  client_id_metadata_document_supported: true
  sources:
  - https://oauth.clozd.com/.well-known/oauth-authorization-server
- name: openIdConnect
  type: openIdConnect
  applies_to:
  - Clozd MCP Server
  - Clozd platform SSO
  openIdConnectUrl: https://oauth.clozd.com/.well-known/openid-configuration
  id_token_signing_alg:
  - RS256
  subject_types:
  - public
  response_types:
  - code
  sources:
  - https://oauth.clozd.com/.well-known/openid-configuration
resource_protection:
  spec: RFC 9728 OAuth 2.0 Protected Resource Metadata
  metadata_url: https://mcp.clozd.com/.well-known/oauth-protected-resource/mcp
  advertised_via_www_authenticate: true
  www_authenticate: >-
    Bearer realm="Clozd MCP",
    resource_metadata="https://mcp.clozd.com/.well-known/oauth-protected-resource/mcp"
  bearer_methods_supported:
  - header
platform_sso:
  supported: true
  protocols:
  - SAML 2.0
  - OIDC
  identity_providers_documented:
  - Okta
  - Microsoft Entra
  - OneLogin
  - Google
  docs:
  - https://help.clozd.com/hc/en-us/articles/45409542002587-Single-Sign-On-SSO
  - https://help.clozd.com/hc/en-us/articles/45094828124827-Configuring-OIDC-for-Authentication-with-Okta
  - https://help.clozd.com/hc/en-us/articles/45717687212059-Setting-up-SAML-Based-SSO-with-OneLogin
  - https://help.clozd.com/hc/en-us/articles/45760689187867-Setting-up-SAML-Based-SSO-with-Entra
gaps:
- The REST Data API has no OAuth option — only a long-lived, organization-wide, non-expiring API token.
- No documented token rotation, expiry or programmatic revocation for the REST API token.
- No read-only vs read-write token distinction on the REST surface.
x-evidence:
  fetched: '2026-08-04'
  urls:
  - url: https://oauth.clozd.com/.well-known/oauth-authorization-server
    http_status: 200
  - url: https://mcp.clozd.com/.well-known/oauth-protected-resource/mcp
    http_status: 200
  - url: https://app.clozd.com/public-api/v3/openapi.json
    http_status: 401
    body: '{"success":false,"message":"API Token Required.","errorCode":"API003"}'
  - url: https://help.clozd.com/api/v2/help_center/en-us/articles/9948957669659.json
    http_status: 200