Diagram · Authentication Profile

Diagram La Authentication

Authentication

Diagram secures its APIs with http and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions.

CompanyDiagrammingVisualizationArtificial IntelligenceMCPCollaborationDeveloper Tools

Methods: http, oauth2 Schemes: 3 OAuth flows: API key in:

Security Schemes

bearer http

scheme: bearer

mcp-oauth oauth2

· flows:

mcp-key-in-url apiKey

· in: path ()

Source

Authentication Profile

generated: '2026-11-05'
method: searched
source: https://diagram.la/docs/api
docs: https://diagram.la/docs/api
summary:
  types:
  - http
  - oauth2
schemes:
- name: bearer
  type: http
  scheme: bearer
  description: Diagram API key (dgm_...)
  applies_to: HTTP API (https://diagram.la/api/v1) and the MCP server (https://diagram.la/mcp)
  docs_text: "Auth: `Authorization: Bearer dgm_...` with a key from the [API keys](https://diagram.la/keys) page."
  key_management: API keys are stored as SHA-256 hashes, shown once, and can be revoked on the API keys page. Each key acts as the account that created it. 20 active API keys per account.
  sources:
  - openapi/diagram-la-openapi.yml
  - https://diagram.la/docs/api
  - https://diagram.la/docs/security
- name: mcp-oauth
  type: oauth2
  description: MCP sign-in for the remote MCP server only (not declared in the OpenAPI). "Sign-in follows the MCP authorization spec - OAuth 2.1 with PKCE and dynamic client registration, discovered from https://diagram.la/.well-known/oauth-protected-resource/mcp."
  applies_to: https://diagram.la/mcp
  flows: [authorizationCode]
  pkce: true
  dynamic_client_registration: true
  discovery: https://diagram.la/.well-known/oauth-protected-resource/mcp
  scopes_documented: false
  sources:
  - https://diagram.la/docs/chat-apps
- name: mcp-key-in-url
  type: apiKey
  in: path
  description: For tools that only take a URL and cannot sign in, the key is embedded in the address https://diagram.la/mcp/<your key>; the docs say to treat it like a password.
  sources:
  - https://diagram.la/docs/chat-apps
end_user_signin: Google or a one-time emailed link (Firebase email link); session is an httpOnly cookie (website only).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/diagram-la-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.