confcall · Authentication Profile

confcall Authentication

Authentication

confcall secures its APIs with apiKey and oauth2 across 4 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

CompanyVideo ConferencingAI AgentsEmbeddable WidgetsTelephonyTranscriptionMCPCommunications

Methods: apiKey, oauth2 Schemes: 4 OAuth flows: clientCredentials API key in: header

Security Schemes

ApiKeyAuth apiKey

· in: header (X-API-Key)

OAuth2ClientCredentials oauth2

· flows: clientCredentials

RoomScopedJWT http

scheme: bearer

PublishableKey apiKey

· in: attribute (api-key)

Source

Authentication Profile

generated: '2026-11-04'
method: searched
source: https://docs.confcall.app/api-reference.html
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: X-API-Key
  description: A confcall secret (sk_live_/sk_test_) API key. Publishable (pk_) keys are rejected on every route
    documented here.
  sources:
  - openapi/confcall-app-openapi.yml
- name: OAuth2ClientCredentials
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.confcall.app/oauth/token
    scopes: 2
  description: 'OAuth 2.0 client-credentials grant. Exchange a client id/secret at the token URL for a short-lived
    bearer JWT and send it as `Authorization: Bearer <token>`. Operations with x-auth jwtOrApiKey accept either
    this or ApiKeyAuth; x-auth jwt operations need a user-context token.'
  sources:
  - openapi/confcall-app-openapi.yml
- name: RoomScopedJWT
  type: http
  scheme: bearer
  description: Room/user-scoped JWT. Routes marked "JWT or sk_" accept it; GET /api/recordings/{id} and /download
    are "JWT only" (human session). Embed session tokens from POST /api/embed/sessions feed the widget auth-token
    attribute.
  sources:
  - https://docs.confcall.app/api-reference.html
  - https://docs.confcall.app/widget.html
- name: PublishableKey
  type: apiKey
  in: attribute
  parameter: api-key
  description: pk_live_/pk_test_ publishable key for the <agent-widget> only; can be restricted to allowed origins.
    Rejected on every control-plane route.
  sources:
  - https://docs.confcall.app/agent-widget.html
docs: https://docs.confcall.app/api-reference.html
key_prefixes:
  secret:
  - sk_live_
  - sk_test_
  publishable:
  - pk_live_
  - pk_test_
notes:
- 'MCP server (https://mcp.confcall.app) accepts X-API-Key: sk_... or Authorization: Bearer sk_...; a request with
  no key is rejected with 401 (per docs, not probed).'
- Keys are created in the dashboard at meet.confcall.app under Developers / API & Embed.
docs_pages:
- https://docs.confcall.app/api-reference.html
- https://docs.confcall.app/mcp-server.html
- https://docs.confcall.app/agent-widget.html

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/confcall-app-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.