DocSend · Authentication Profile

Docsend Authentication

Authentication

DocSend secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, and refreshToken flow(s).

CompanyEnterpriseDocument SharingSales EnablementAnalyticsData RoomE-SignatureMCPDropbox

Methods: oauth2 Schemes: 1 OAuth flows: authorizationCode, clientCredentials, refreshToken API key in:

Security Schemes

OAuth2 oauth2

· flows: authorizationCode, clientCredentials

Source

Authentication Profile

generated: '2026-08-14'
method: searched
source: >-
  https://docsend.com/.well-known/oauth-authorization-server (RFC 8414),
  https://mcp.docsend.com/.well-known/oauth-authorization-server (RFC 8414),
  https://docsend.com/.well-known/oauth-protected-resource/mcp (RFC 9728), and the
  WWW-Authenticate challenge returned by https://docsend.com/mcp and
  https://mcp.docsend.com/mcp
summary:
  types: [oauth2]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken]
  pkce: S256
  dynamic_client_registration: true
  token_endpoint_auth_methods: [none]
  bearer_methods: [header]
  protected_resource_metadata: true
schemes:
- name: OAuth2
  type: oauth2
  sources:
  - well-known/docsend-oauth-authorization-server.json
  - well-known/docsend-mcp-host-oauth-authorization-server.json
  - well-known/docsend-oauth-protected-resource-mcp.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://docsend.com/oauth/authorize
    tokenUrl: https://docsend.com/oauth/token
    refreshUrl: https://docsend.com/oauth/token
    scopes:
      documents:read: Read access to DocSend documents and share links
      spaces:read: Read access to DocSend Spaces (virtual data rooms)
      spaces:write: Write access to DocSend Spaces (virtual data rooms)
      analytics:read: Read access to viewer/page engagement analytics
      contacts:read: Read access to contacts / visitors
  - flow: clientCredentials
    tokenUrl: https://docsend.com/oauth/token
    scopes:
      documents:read: Read access to DocSend documents and share links
      spaces:read: Read access to DocSend Spaces (virtual data rooms)
      spaces:write: Write access to DocSend Spaces (virtual data rooms)
      analytics:read: Read access to viewer/page engagement analytics
      contacts:read: Read access to contacts / visitors
  registration_endpoint: https://docsend.com/oauth/register
  revocation_endpoint: https://docsend.com/oauth/revoke
  code_challenge_methods: [S256]
  token_endpoint_auth_methods: [none]
issuers:
- issuer: https://docsend.com
  metadata: https://docsend.com/.well-known/oauth-authorization-server
- issuer: https://mcp.docsend.com
  metadata: https://mcp.docsend.com/.well-known/oauth-authorization-server
  note: >-
    Advertises the same endpoints on docsend.com; the RFC 9728 resource document names
    https://docsend.com as the sole authorization server.
protected_resource:
  resource: https://docsend.com/mcp
  metadata: https://docsend.com/.well-known/oauth-protected-resource/mcp
  authorization_servers: [https://docsend.com]
  bearer_methods_supported: [header]
docs: null
notes: >-
  DocSend operates a full OAuth 2.0 authorization server with RFC 8414 discovery, RFC 7591
  dynamic client registration, RFC 7636 PKCE (S256 mandatory), RFC 7009 token revocation
  and RFC 9728 protected-resource metadata. token_endpoint_auth_methods_supported is
  ["none"], i.e. public clients registering dynamically and authenticating with PKCE —
  the standard MCP client shape. This authorization surface exists to gate the hosted MCP
  server; DocSend publishes no general-purpose REST API and no OpenAPI, and no readable
  authentication documentation page (www.docsend.com and help.docsend.com return HTTP 403
  to non-browser clients), so this profile is built entirely from the machine-readable
  discovery documents DocSend serves.
changes_since_last_round:
  checked: '2026-08-14'
  previous: '2026-07-18'
  notes: >-
    Scopes changed from mcp:read / mcp:write to five resource-scoped values, and RFC 9728
    protected-resource metadata appeared (it 404d on the previous pass).

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/docsend-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.