Cooklist · Authentication Profile

Cooklist Authentication

Authentication

Cooklist secures its APIs with apiKey and http across 2 declared security schemes, as derived from its OpenAPI definitions.

CompanyAgentic CommerceGroceryRetailAI AssistantModel Context ProtocolRecipesMeal PlanningE-CommercePersonalization
Methods: apiKey, http Schemes: 2 OAuth flows: API key in: header

Security Schemes

apiKey apiKey
· in: header ()
jwt http
scheme: bearer

Source

Authentication Profile

cooklist-authentication.yml Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://cooklist.com/llms.txt
docs: https://cooklist.com/platform/agentic-commerce
# Derived from the documented integration model in the platform docs / llms.txt.
# Cooklist publishes no public OpenAPI, so this is a docs-searched auth profile
# rather than a spec derivation.
summary:
  types: [apiKey, http]
  api_key_in: [header]
  http_schemes: [bearer]
  model: B2B Partner API with per-organization field allowlists (deny-by-default, token-scoped)
schemes:
- name: apiKey
  type: apiKey
  in: header
  description: B2B Partner API key mode for authenticating a retailer/partner integration.
  sources: [https://cooklist.com/llms.txt]
- name: jwt
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: JWT token mode for the B2B Partner API; the embedded SDK obtains session tokens via a retailer-controlled token-mint mechanism.
  sources: [https://cooklist.com/llms.txt]
access_controls:
- Per-organization field allowlists restrict each retailer to the capabilities and data scoped to their integration.
- Deny-by-default, token-scoped access with tenant isolation enforced at app and DB layers.
- Signed / scoped session tokens prevent user impersonation; tool access is allow-listed (no open web browsing).