Dilohost · Authentication Profile

Dilohost Es Authentication

Authentication

Dilohost declares 3 security scheme(s) across its OpenAPI definitions.

CompanyHostingWeb HostingMCPAI AgentsDatabaseDomainsEmailEuropean Union
Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

oauth2
· flows:
http
scheme: bearer
note

Source

Authentication Profile

dilohost-es-authentication.yml Raw ↑ 
generated: '2026-11-05'
method: searched
source: https://dilohost.es/docs/referencia/servidor-mcp
docs: https://dilohost.es/docs/referencia/servidor-mcp
name: Dilohost authentication
note: Dilohost publishes no OpenAPI; this profile is read from the MCP server reference and the service-token page. Values are as documented, not observed (no token or OAuth endpoint was called).
schemes:
- id: oauth2
  type: oauth2
  description: OAuth 2.1 authorization code with PKCE (S256 mandatory) and RFC 8707 resource indicator resource=https://mcp.dilohost.es/mcp. Public clients only (token_endpoint_auth_methods_supported none). Clients identify via Client ID Metadata Document (preferred; only trusted clients Claude Code, claude.ai/Claude Desktop and Codex accepted) or dynamic client registration (RFC 7591, max 20 registrations per hour and IP).
  flows:
    authorizationCode:
      authorizationUrl: https://dilohost.es/oauth/authorize
      tokenUrl: https://dilohost.es/oauth/token
      registrationUrl: https://dilohost.es/oauth/register
      scopes:
        mcp:use: Access to the Dilohost MCP server
  discovery:
    protected_resource_metadata: https://mcp.dilohost.es/.well-known/oauth-protected-resource
    authorization_server_metadata: https://dilohost.es/.well-known/oauth-authorization-server
    www_authenticate: 'Bearer realm="mcp", resource_metadata="https://mcp.dilohost.es/.well-known/oauth-protected-resource/mcp", scope="mcp:use"'
  tokens:
    access_token: 1 hour, JWT with RFC 9068 profile (typ at+jwt); audience includes the MCP URL
    refresh_token: 30 days, rotated on every use; reuse of a spent token revokes all access for that client and person
  errors:
    missing_token: 401 with WWW-Authenticate
    insufficient_scope: 403 insufficient_scope
    wrong_resource: invalid_target
- id: serviceToken
  type: http
  scheme: bearer
  description: Service tokens created by the account owner in the panel (Ajustes -> Tokens de servicio), prefix dhs_, valid 1 to 365 days, up to 20 active per account, shown once (only a hash is stored). Sent as Authorization Bearer dhs_... Acts as a team member, not as owner (no team, plan, payments or spend cap).
  prefix: dhs_
  docs: https://dilohost.es/docs/cuenta/tokens
- id: originValidation
  type: note
  description: Requests carrying an Origin header not on the allow-list receive 403 with JSON-RPC error -32600 "Origin no permitido." (DNS-rebinding protection).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/dilohost-es-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.