Cve Security Com Authentication

generated: '2026-11-05'
method: searched
source: https://cve-security.com/auth.md
docs: https://cve-security.com/auth.md
summary:
  types:
  - apiKey
  - http
  api_key_in:
  - header
  oauth: false
  key_prefix: cvs_live_
schemes:
- name: bearer
  type: http
  scheme: bearer
  description: 'Authorization: Bearer cvs_live_…'
  sources:
  - openapi/cve-security-com-openapi.yml
  - https://cve-security.com/auth.md
- name: apiKey
  type: apiKey
  in: header
  parameter: X-API-Key
  description: Alternative to the Authorization header. Keys are never accepted in query strings.
  sources:
  - openapi/cve-security-com-openapi.yml
  - https://cve-security.com/auth.md
provisioning:
  self_serve: true
  operation: createApiKey
  description: 'Register with one POST to /api/signup with an email; returns 201 with api_key, tier "free" and daily_limit 1000. Only a SHA-256 hash of the key is stored server-side; the raw key is shown once. Re-registering an existing email returns 409. A lost key is reissued through the contact form.'
keyless_surfaces:
- POST /api/mcp (100 tool calls per caller per UTC day)
- GET /api/search and GET /api/entities (per-IP rate limited)
- GET /api/scoreboard/* (open data, CC BY 4.0)
- /feeds/updates.xml and per-type Atom feeds
notes: 'Docs state there is no OAuth server: "/.well-known/openid-configuration and OAuth discovery documents are absent because there is no OAuth server". Query-string keys are rejected.'