Contentstack Authentication

generated: '2026-09-17'
method: searched
source: openapi/contentstack-accounts-api-openapi.yml, openapi/contentstack-analytics-api-openapi.yml, openapi/contentstack-assets-api-openapi.yml,
  openapi/contentstack-attributes-api-openapi.yml, openapi/contentstack-audiences-api-openapi.yml, openapi/contentstack-audit-logs-api-openapi.yml,
  openapi/contentstack-automations-api-openapi.yml, openapi/contentstack-brand-kits-api-openapi.yml, openapi/contentstack-content-types-api-openapi.yml,
  openapi/contentstack-deployments-api-openapi.yml, openapi/contentstack-entries-api-openapi.yml, openapi/contentstack-entry-variants-api-openapi.yml
  ... — upgraded with https://www.contentstack.com/docs/developer-hub/contentstack-oauth and https://www.contentstack.com/docs/developers/create-tokens/about-management-tokens
  (both HTTP 200, read 2026-09-17)
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  description: OAuth 2.0 Bearer token with appropriate Automate scopes.
  sources:
  - openapi/contentstack-accounts-api-openapi.yml
  - openapi/contentstack-analytics-api-openapi.yml
  - openapi/contentstack-attributes-api-openapi.yml
  - openapi/contentstack-audiences-api-openapi.yml
  - openapi/contentstack-audit-logs-api-openapi.yml
  - openapi/contentstack-automations-api-openapi.yml
  - openapi/contentstack-brand-kits-api-openapi.yml
  - openapi/contentstack-deployments-api-openapi.yml
  - openapi/contentstack-environments-api-openapi.yml
  - openapi/contentstack-events-api-openapi.yml
  - openapi/contentstack-execution-logs-api-openapi.yml
  - openapi/contentstack-experiences-api-openapi.yml
  - openapi/contentstack-file-uploads-api-openapi.yml
  - openapi/contentstack-geolocation-api-openapi.yml
  - openapi/contentstack-llm-configuration-api-openapi.yml
  - openapi/contentstack-projects-api-openapi.yml
  - openapi/contentstack-scim-groups-api-openapi.yml
  - openapi/contentstack-scim-schema-discovery-api-openapi.yml
  - openapi/contentstack-scim-users-api-openapi.yml
  - openapi/contentstack-variables-api-openapi.yml
  - openapi/contentstack-voice-profiles-api-openapi.yml
- name: authtokenAuth
  type: apiKey
  in: header
  parameter: authtoken
  description: Contentstack user authtoken for session-based authentication.
  sources:
  - openapi/contentstack-accounts-api-openapi.yml
  - openapi/contentstack-analytics-api-openapi.yml
  - openapi/contentstack-assets-api-openapi.yml
  - openapi/contentstack-attributes-api-openapi.yml
  - openapi/contentstack-audiences-api-openapi.yml
  - openapi/contentstack-audit-logs-api-openapi.yml
  - openapi/contentstack-automations-api-openapi.yml
  - openapi/contentstack-brand-kits-api-openapi.yml
  - openapi/contentstack-content-types-api-openapi.yml
  - openapi/contentstack-deployments-api-openapi.yml
  - openapi/contentstack-entries-api-openapi.yml
  - openapi/contentstack-environments-api-openapi.yml
  - openapi/contentstack-events-api-openapi.yml
  - openapi/contentstack-execution-logs-api-openapi.yml
  - openapi/contentstack-experiences-api-openapi.yml
  - openapi/contentstack-file-uploads-api-openapi.yml
  - openapi/contentstack-geolocation-api-openapi.yml
  - openapi/contentstack-llm-configuration-api-openapi.yml
  - openapi/contentstack-organizations-api-openapi.yml
  - openapi/contentstack-projects-api-openapi.yml
  - openapi/contentstack-stacks-api-openapi.yml
  - openapi/contentstack-user-sessions-api-openapi.yml
  - openapi/contentstack-users-api-openapi.yml
  - openapi/contentstack-variables-api-openapi.yml
  - openapi/contentstack-voice-profiles-api-openapi.yml
- name: apiKey
  type: apiKey
  in: header
  parameter: api_key
  description: The API key for the Contentstack stack.
  sources:
  - openapi/contentstack-assets-api-openapi.yml
  - openapi/contentstack-content-types-api-openapi.yml
  - openapi/contentstack-entries-api-openapi.yml
  - openapi/contentstack-entry-variants-api-openapi.yml
  - openapi/contentstack-global-fields-api-openapi.yml
  - openapi/contentstack-synchronization-api-openapi.yml
- name: deliveryToken
  type: apiKey
  in: header
  parameter: access_token
  description: The delivery token granting read access to the stack environment.
  sources:
  - openapi/contentstack-assets-api-openapi.yml
  - openapi/contentstack-content-types-api-openapi.yml
  - openapi/contentstack-entries-api-openapi.yml
  - openapi/contentstack-entry-variants-api-openapi.yml
  - openapi/contentstack-global-fields-api-openapi.yml
  - openapi/contentstack-synchronization-api-openapi.yml
- name: managementTokenAuth
  type: apiKey
  in: header
  parameter: authorization
  description: Management token in the format "Bearer {management_token}" for server-to-server authentication without
    user sessions.
  sources:
  - openapi/contentstack-assets-api-openapi.yml
  - openapi/contentstack-content-types-api-openapi.yml
  - openapi/contentstack-entries-api-openapi.yml
  - openapi/contentstack-environments-api-openapi.yml
  - openapi/contentstack-organizations-api-openapi.yml
  - openapi/contentstack-stacks-api-openapi.yml
  - openapi/contentstack-user-sessions-api-openapi.yml
  - openapi/contentstack-users-api-openapi.yml
docs: https://www.contentstack.com/docs/developers/create-tokens/about-management-tokens
oauth:
  documented: true
  docs: https://www.contentstack.com/docs/developer-hub/contentstack-oauth
  flow: authorization_code
  token_types:
  - app token (machine-to-machine)
  - user token (on behalf of a user)
  scopes: scopes/contentstack-scopes.yml
  scope_count: 95
  note: OAuth 2.0 is the delegated-access path used by Developer Hub apps and by the first-party MCP server. It
    is not visible in the securitySchemes of the specs in this repository, which declare the header-token schemes
    only — so the derived profile below understates the real auth surface.
token_kinds:
- name: Stack API key
  header: api_key
  purpose: Selects the stack. Required on every delivery and most management calls; not a secret on its own.
- name: Delivery token
  header: access_token
  purpose: Read-only access scoped to one environment of one stack.
- name: Management token
  header: 'authorization: Bearer <token>'
  purpose: Server-to-server write access to one stack, with no user session.
- name: Authtoken
  header: authtoken
  purpose: User session token from the login endpoint.
- name: OAuth access token
  header: 'authorization: Bearer <token>'
  purpose: Delegated access carrying explicit scopes; the only mechanism with least-privilege granularity.
note: Five distinct token kinds across the estate. Only the OAuth path carries scopes; a management token is all-or-nothing
  for the stack it is issued against.