DialMCP · Authentication Profile

Dialmcp Com Authentication

Authentication

DialMCP declares 1 security scheme(s) across its OpenAPI definitions.

CompanyMCPAI AgentsPhone CallsVoice AITelephony
Methods: Schemes: 1 OAuth flows: API key in:

Security Schemes

oauth2

Source

Authentication Profile

dialmcp-com-authentication.yml Raw ↑ 
generated: '2026-11-05'
method: searched
source: https://dialmcp.com/docs/oauth
docs: https://dialmcp.com/docs/oauth
name: DialMCP authentication
summary: OAuth 2.1 (authorization code + PKCE, refresh token) for the hosted remote MCP endpoint https://mcp.dialmcp.com/mcp; no API keys; sign-in verifies a US/Canadian mobile number by SMS, which becomes the caller ID.
schemes:
- id: oauth2
  type: oauth2
  flow: authorizationCode
  pkce: [plain, S256]
  issuer: https://mcp.dialmcp.com
  authorization_endpoint: https://mcp.dialmcp.com/authorize
  token_endpoint: https://mcp.dialmcp.com/token
  registration_endpoint: https://mcp.dialmcp.com/register
  dynamic_client_registration: RFC 7591
  client_id_metadata_documents: false
  grant_types: [authorization_code, refresh_token]
  token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
  protected_resource_metadata: https://mcp.dialmcp.com/.well-known/oauth-protected-resource/mcp
  authorization_server_metadata: https://mcp.dialmcp.com/.well-known/oauth-authorization-server
  openid_connect: false
  bearer_methods: [header]
  scopes: none
  token_format: opaque (not JWT)
  access_token_lifetime: 1 hour (expires_in 3600)
  refresh_token: rotating; the previous token keeps working until the next refresh
  authorization_code_lifetime: 10 minutes, single-use
  revocation: Not documented; "This does not revoke the grant on DialMCP's side" when a client is removed.
  notes:
  - Tokens are never accepted in the query string.
  - Static bearer tokens are not accepted; only tokens issued through this flow.
  - Unauthenticated requests get HTTP 401 with WWW-Authenticate Bearer error="invalid_token" and resource_metadata.
  - The browser sign-in flow must finish within 10 minutes; five wrong SMS codes lock the flow.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/dialmcp-com-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.