Fullcast Authentication

generated: '2026-08-13'
method: searched
source: openapi/fullcast-assistant-openapi-original.json
docs:
- https://support.fullcast.com/docs/set-up-the-model-context-protocol-mcp.md
- https://support.fullcast.com/copy-ai/docs/api-key-management.md
- https://assistant.fullcast.io/.well-known/oauth-authorization-server
- https://app.fullcast.io/mcp/.well-known/oauth-authorization-server
note: >-
  Upgraded from the mechanical derive, which saw only the two apiKey schemes declared in the
  Assistant OpenAPI. Fullcast actually runs THREE distinct authentication models across three
  surfaces, and the OpenAPI declares the weakest one: the same host that serves that spec also
  runs a full OAuth 2.1 authorization server whose /oauth/* operations are IN the document but
  are not wired into components.securitySchemes. All OAuth detail below was read from live
  RFC 8414 / RFC 9728 metadata, not inferred.
summary:
  types: [apiKey, oauth2]
  api_key_in: [cookie, header]
  oauth2_flows: [authorizationCode]
  pkce: [S256, plain]
  dynamic_client_registration: true
  surfaces: 3
schemes:
- name: APIKeyCookie
  type: apiKey
  in: cookie
  parameter: token
  surface: Fullcast Assistant API
  host: https://assistant.fullcast.io
  sources: [openapi/fullcast-assistant-openapi-original.json]
  note: browser session cookie, not a developer credential
- name: APIKeyHeader
  type: apiKey
  in: header
  parameter: csrf_token
  surface: Fullcast Assistant API
  host: https://assistant.fullcast.io
  sources: [openapi/fullcast-assistant-openapi-original.json]
  note: CSRF companion to the cookie above
- name: Fullcast MCP OAuth 2.1
  type: oauth2
  surface: Fullcast MCP
  host: https://app.fullcast.io/mcp
  bearer_in: header
  flows:
  - flow: authorizationCode
    issuer: https://app.fullcast.io/mcp
    authorizationUrl: https://app.fullcast.io/mcp/authorize
    tokenUrl: https://app.fullcast.io/mcp/token
    registrationUrl: https://app.fullcast.io/mcp/register
    pkce: [S256]
    token_endpoint_auth_methods: [client_secret_post, none]
    scopes: []
  sources: [well-known/fullcast-app-mcp-oauth-authorization-server.json]
  verified: >-
    401 MISSING_BEARER with WWW-Authenticate Bearer realm="mcp-openapi" observed 2026-08-13
- name: Fullcast Assistant OAuth 2.1
  type: oauth2
  surface: Fullcast Assistant MCP Server
  host: https://assistant.fullcast.io
  bearer_in: header
  flows:
  - flow: authorizationCode
    issuer: https://assistant.fullcast.io
    authorizationUrl: https://assistant.fullcast.io/oauth/authorize
    tokenUrl: https://assistant.fullcast.io/oauth/token
    registrationUrl: https://assistant.fullcast.io/oauth/register
    userinfoUrl: https://assistant.fullcast.io/oauth/userinfo
    pkce: [plain, S256]
    token_endpoint_auth_methods: [client_secret_post, none]
    scopes: [openid, email, profile, offline_access, 'mcp:resources', 'mcp:tools', 'mcp:prompts']
  sources: [well-known/fullcast-assistant-oauth-authorization-server.json]
  refresh_tokens: true
  token_response_fields: [access_token, jwe_access_token, token_type, expires_in, refresh_token, scope]
- name: Copy.ai workspace API key
  type: apiKey
  in: header
  parameter: x-copy-ai-api-key
  surface: Fullcast Copy.ai Workflows API
  host: https://api.copy.ai/api
  sources: [https://support.fullcast.com/copy-ai/docs/api-key-management.md]
  lifecycle:
    created_in: Configuration > API Keys > Create API Key
    shown_once: true
    default_expiry: never
    recommended_expiry: 12 months
    permission_model: key inherits all access permissions of the user it is assigned to
    scoping_advice: assign the key to a restricted user or Teamspace to limit its blast radius
    operations: [disable, enable, rename, delete]
    managed_by: [Workspace Owner, Admin]
tenant_gate:
  note: >-
    MCP access is off by default. A tenant admin must enable it at
    Settings > Application Settings > AI & Agents > Enable AI Assistant Features before any
    token will work.
  docs: https://support.fullcast.com/docs/enable-ai-features.md
platform_controls:
- multi-factor authentication
- role-based access control with granular permissions
- IP and country login restrictions (https://support.fullcast.com/docs/configure-ip-and-country-restrictions.md)
gaps:
- >-
  The OpenAPI does not declare the OAuth 2.1 scheme its own /oauth/* operations implement, so
  a generated client sees only cookie + CSRF auth. Captured as a correction in
  overlays/fullcast-assistant-overlay.yaml.
- The assistant issuer still advertises PKCE method "plain" alongside S256.
- 'mcp:tools is a single scope covering both read and write tools; there is no read-only scope.'
- No published developer API key exists for the Fullcast platform itself - only for the acquired Copy.ai product.