Ellipsis · Authentication Profile

Ellipsis Authentication

Authentication

Ellipsis secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the deviceCode flow(s).

CompanyCode ReviewAI AgentsCoding AgentsDeveloper ToolsSoftware DevelopmentAutomationDevOpsPull Requests

Methods: http, oauth2 Schemes: 2 OAuth flows: deviceCode API key in: header

Security Schemes

bearerToken http

scheme: bearer

deviceCodeLogin oauth2

Source

Authentication Profile

generated: '2026-07-19'
method: searched
source: https://www.ellipsis.dev/docs/reference/api
docs: https://www.ellipsis.dev/docs/reference/api
summary:
  types: [http, oauth2]
  api_key_in: [header]
  oauth2_flows: [deviceCode]
schemes:
- name: bearerToken
  type: http
  scheme: bearer
  description: >-
    REST API requests authenticate with a bearer token created in the dashboard
    under Platform -> API keys (token format `ellipsis_key_...`), passed as
    `Authorization: Bearer <token>`. Requests without valid authorization return
    HTTP 401. In scripts/CI the token is supplied via the `ELLIPSIS_API_TOKEN`
    environment variable.
  location: header
  header: Authorization
  format: Bearer
  env: ELLIPSIS_API_TOKEN
- name: deviceCodeLogin
  type: oauth2
  flow: deviceCode
  description: >-
    The `agent` CLI authenticates interactively via a device-code flow
    (`agent login`): it opens a verification URL in the browser and stores a
    user token at ~/.config/ellipsis/config.json.
  used_by: cli
session_credentials:
  note: >-
    Each agent session additionally receives its own short-lived credentials —
    a GitHub token scoped to the permissions/repos granted at install, a
    synthetic API key, and a session-scoped token — all revoked at teardown
    (least privilege). Sandbox tokens are denied privileged operations (HTTP 403).
scopes: none-documented

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/ellipsis-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.