DimensionKit · Authentication Profile

Dimensionkit Com Authentication

Authentication

DimensionKit declares 1 security scheme(s) across its OpenAPI definitions.

CompanyAssessmentScorecardsLead GenerationMCPArtificial IntelligenceQuizzes
Methods: Schemes: 1 OAuth flows: API key in:

Security Schemes

oauth2 oauth2
· flows:

Source

Authentication Profile

dimensionkit-com-authentication.yml Raw ↑
generated: '2026-11-05'
method: searched
source: https://dimensionkit.com/docs/mcp/connecting/
docs: https://dimensionkit.com/docs/mcp/connecting/
name: DimensionKit authentication
schemes:
- name: oauth2
  type: oauth2
  applies_to: https://app.dimensionkit.com/mcp
  description: 'OAuth 2.1, authorization code with PKCE. Dynamic client registration (RFC 7591) is open, which is what makes pasting the URL enough. Nothing is issued by hand - there are no API keys to copy.'
  flows:
    authorizationCode:
      issuer: https://app.dimensionkit.com
      registrationUrl: https://app.dimensionkit.com/oauth/register
      revocationUrl: https://app.dimensionkit.com/oauth/revoke
      pkce: S256
      grant_types: [authorization_code, refresh_token]
      token_endpoint_auth_methods: [none, client_secret_post, client_secret_basic]
      scopes:
        scorecards:read: View your scorecards, their configuration, and submissions
        scorecards:write: Create, edit, and publish your scorecards
  bearer_methods: [header]
  discovery:
    protected_resource_metadata: https://app.dimensionkit.com/.well-known/oauth-protected-resource
    authorization_server_metadata: https://app.dimensionkit.com/.well-known/oauth-authorization-server
    note: The 401 from /mcp carries a WWW-Authenticate header whose resource_metadata parameter points at the RFC 9728 document.
  token_lifetimes:
    access_token: 1 hour
    refresh_token: 30 days (rotating; each refresh issues a new refresh token)
  redirect_uris: https:// , custom schemes such as cursor:// , and http:// for loopback addresses only
  revocation: RFC 7009 at /oauth/revoke; revoking either token revokes both halves of the grant
  prerequisites: Email verification is required before a connector can be approved.
evidence:
- url: https://app.dimensionkit.com/.well-known/oauth-protected-resource
  http_status: 200
- url: https://app.dimensionkit.com/.well-known/oauth-authorization-server
  http_status: 200
- url: https://dimensionkit.com/docs/mcp/managing/

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact
curl "https://apis.io/api/v1/security/dimensionkit-com-authentication"
All security posture
curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

A second provider on the same verified email joins the account you already have.