CMD+K · Authentication Profile

Commandplusk Authentication

Authentication

Authentication modes for CMD+K MCP deployments as described in the documentation.

CMD+K declares 3 security scheme(s) across its OpenAPI definitions.

Artificial IntelligenceAssistantPlatformSoftware-as-a-ServiceDevelopers
Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

Per‑customer API key apiKey
Per‑customer OAuth oauth2
· flows:
Shared access token (internal/team edge case) http-bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-10-16'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://commandplusk.com/docs/build-mcp/authentication
sources:
- https://commandplusk.com/docs/build-mcp/authentication
- https://commandplusk.com/docs/widget/end-user-oauth
- https://commandplusk.com/docs/widget/jwt-auth
- https://commandplusk.com/docs/widget/overview
description: Authentication modes for CMD+K MCP deployments as described in the documentation.
schemes:
- type: apiKey
  name: Per‑customer API key
  evidence: Customers use their own API keys (recommended). Each customer opens your MCP's connect page and pastes the API key they already have
    with your product.
  how_to_obtain: Customer provides the existing API key from your product on the MCP connect page.
- type: oauth2
  name: Per‑customer OAuth
  evidence: Customers sign in with your OAuth. Same per‑customer identity, via your OAuth server. Configure your authorize/token URLs and client
    ID in the Privacy tab; we run the full authorization‑code flow (with PKCE) and refresh tokens automatically.
  flows:
  - authorization_code
  how_to_obtain: Configure authorize and token URLs and client ID in the CMD+K deployment's Privacy tab; CMD+K runs the PKCE‑enabled authorization‑code
    flow.
- type: http-bearer
  name: Shared access token (internal/team edge case)
  evidence: Shared access token (internal/team edge case). All callers use the workspace's stored token — your API cannot tell them apart.
  location: header
  header: Authorization
  how_to_obtain: Workspace stores a token that is used for all calls; no per‑customer credential is required.
docs: https://commandplusk.com/docs/build-mcp/authentication
note: 1 extracted row(s) were dropped because their quote was not on the page.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/commandplusk-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.