Dreamthreads Authentication

generated: '2026-08-14'
method: searched
source: openapi/dreamthreads-dreamgraph-openapi.yml
docs:
  - https://mydreamthreads.xyz/dream-interpretation-api#request-access
  - https://mydreamthreads.xyz/.well-known/api-onboarding
summary:
  types:
  - http
  - none
  http_schemes:
  - bearer
  keyless_surfaces: 3
  reviewed_surfaces: 2
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: DreamThreads partner API key
  applies_to:
  - interpretDream
  - parseDream
  sources:
  - openapi/dreamthreads-dreamgraph-openapi.yml
- name: none
  type: none
  applies_to:
  - getDreamGraphHealth
  - parseDreamPublicly
  - mcp:parse_dream
  - mcp:search_dream_concepts
  note: >-
    Declared explicitly in the OpenAPI as an empty operation-level `security: []` override on
    /health and /public/parse, and confirmed anonymously against the live MCP server.
access_model:
  keyless:
    - surface: POST /api/v1/dreamgraph/public/parse
      auth: none
      note: CORS-enabled, 12/min and 100/day per client, dream text not stored.
    - surface: GET /api/v1/dreamgraph/health
      auth: none
    - surface: https://mydreamthreads.xyz/mcp
      auth: none
      note: Streamable HTTP MCP server, anonymous tools/list confirmed 2026-08-14.
  reviewed:
    - surface: POST /api/v1/dreamgraph/interpret
      auth: bearer
    - surface: POST /api/v1/dreamgraph/parse
      auth: bearer
credential_issuance:
  mechanism: human review
  request_url: https://mydreamthreads.xyz/dream-interpretation-api#request-access
  issued_by: DreamThreads after partner review
  automatic_keys: false
  note: >-
    The provider states plainly that there are no automatic keys — a partner integration form is
    reviewed by a human before a bearer key is issued.
key_handling:
  storage: keys hashed at rest
  binding: tied to a partner account and restricted by origin
  controls: [rate-limited, pausable, rotatable]
  client_side_use: forbidden — partner keys must stay in a server-side secret manager
  rotation_contact: rahim@mydreamthreads.xyz
oauth2: false
openid_connect: false
mutual_tls: false
scopes:
  model: endpoint
  note: >-
    No OAuth scope surface exists. Authorization is per-endpoint: keyless operations are open, and a
    partner key authorizes the reviewed endpoints enabled for that integration. scopes/ is
    intentionally not emitted.
embed_tokens:
  mechanism: short-lived, origin-bound token issued to an approved domain for the hosted embed
  note: Keeps the partner key out of browser code. See components/dreamthreads-components.yml.