DimensionKit · Authentication Profile
Dimensionkit Com Authentication
Authentication
DimensionKit declares 1 security scheme(s) across its OpenAPI definitions.
CompanyAssessmentScorecardsLead GenerationMCPArtificial IntelligenceQuizzes
Methods:
Schemes: 1
OAuth flows:
API key in:
Security Schemes
oauth2 oauth2
· flows:
Source
Authentication Profile
generated: '2026-11-05'
method: searched
source: https://dimensionkit.com/docs/mcp/connecting/
docs: https://dimensionkit.com/docs/mcp/connecting/
name: DimensionKit authentication
schemes:
- name: oauth2
type: oauth2
applies_to: https://app.dimensionkit.com/mcp
description: 'OAuth 2.1, authorization code with PKCE. Dynamic client registration (RFC 7591) is open, which is what makes pasting the URL enough. Nothing is issued by hand - there are no API keys to copy.'
flows:
authorizationCode:
issuer: https://app.dimensionkit.com
registrationUrl: https://app.dimensionkit.com/oauth/register
revocationUrl: https://app.dimensionkit.com/oauth/revoke
pkce: S256
grant_types: [authorization_code, refresh_token]
token_endpoint_auth_methods: [none, client_secret_post, client_secret_basic]
scopes:
scorecards:read: View your scorecards, their configuration, and submissions
scorecards:write: Create, edit, and publish your scorecards
bearer_methods: [header]
discovery:
protected_resource_metadata: https://app.dimensionkit.com/.well-known/oauth-protected-resource
authorization_server_metadata: https://app.dimensionkit.com/.well-known/oauth-authorization-server
note: The 401 from /mcp carries a WWW-Authenticate header whose resource_metadata parameter points at the RFC 9728 document.
token_lifetimes:
access_token: 1 hour
refresh_token: 30 days (rotating; each refresh issues a new refresh token)
redirect_uris: https:// , custom schemes such as cursor:// , and http:// for loopback addresses only
revocation: RFC 7009 at /oauth/revoke; revoking either token revokes both halves of the grant
prerequisites: Email verification is required before a connector can be approved.
evidence:
- url: https://app.dimensionkit.com/.well-known/oauth-protected-resource
http_status: 200
- url: https://app.dimensionkit.com/.well-known/oauth-authorization-server
http_status: 200
- url: https://dimensionkit.com/docs/mcp/managing/
Work with this as data
Every security artifact here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for security posture
4 MCP tools reach this
find_securityBrowse and filter every security artifact in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This security artifact
curl "https://apis.io/api/v1/security/dimensionkit-com-authentication"
All security posture
curl "https://apis.io/api/v1/security?limit=25"
Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.