Cooler Heads · Authentication Profile

Cooler Heads Authentication

Authentication

Cooler Heads declares 2 security scheme(s) across its OpenAPI definitions.

CompanyMedical DevicesHealthcareOncologyScalp CoolingPatient CareMCP

Methods: Schemes: 2 OAuth flows: API key in:

Security Schemes

none none

visitorToken bearer-like session token

Source

Authentication Profile

generated: '2026-08-09'
method: searched
source: https://www.coolerheads.com/llms.txt
docs: https://dev.wix.com/docs/develop-websites/articles/get-started/about-the-wix-site-mcp
summary: >-
  Cooler Heads publishes no developer API and therefore no API key programme, OAuth
  server or developer credential of any kind. The one callable surface it serves is the
  anonymous Wix Site MCP endpoint. Connecting to that endpoint requires no
  authentication at all; acting on a visitor's behalf requires an ephemeral visitor
  token that any anonymous caller can mint from the endpoint itself via the
  GenerateVisitorToken tool. There is no user login, no consent step, and no scope
  model.
schemes:
- name: none
  applies_to: https://www.coolerheads.com/_api/mcp
  type: none
  description: >-
    The MCP transport accepts unauthenticated JSON-RPC. initialize, tools/list and the
    read-only tools (GetBusinessDetails, SearchInSite, SearchSiteApiDocs, the Wix docs
    readers) all returned 200 with no credential presented.
  evidence: 'POST tools/list with no Authorization header returned HTTP 200 with 9 tools (probed 2026-08-09)'
- name: visitorToken
  applies_to: https://www.coolerheads.com/_api/mcp
  type: bearer-like session token
  description: >-
    CallWixSiteAPI and ExecuteWixAPI require a visitorToken argument. The token is
    obtained from the same endpoint by calling GenerateVisitorToken, which itself takes
    no parameters and no credential — so the token is an anonymous session handle, not
    an authentication factor. It scopes the caller to the Wix visitor role on this site.
  issued_by: GenerateVisitorToken tool on https://www.coolerheads.com/_api/mcp
  evidence: 'tools/list inputSchema for CallWixSiteAPI and ExecuteWixAPI marks visitorToken as required'
discovery:
  openid_configuration: absent (HTTP 400)
  oauth_authorization_server: absent (HTTP 400)
  oauth_protected_resource: absent (HTTP 400 at host root, 404 under /_api/mcp)
scopes: none published
absent:
- API key programme
- OAuth 2.0 / OIDC
- mTLS
- signed requests
- developer account or sign-up
x-evidence:
  fetched: '2026-08-09'
  urls:
  - url: https://www.coolerheads.com/llms.txt
    http_status: 200
  - url: https://www.coolerheads.com/_api/mcp
    http_status: 200
  - url: https://www.coolerheads.com/.well-known/openid-configuration
    http_status: 400

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/cooler-heads-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.