Gainsight Authentication

generated: '2026-09-17'
method: searched
source: https://developer-portal.gainsight.com/docs/api/api-authentication.md, https://support.gainsight.com/gainsight_nxt/01Onboarding_and_Implementation/Onboarding_for_Gainsight_NXT/Login_and_Permissions/OAuth_for_Gainsight_APIs, https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/User_Management_APIs/SCIM_API, well-known/gainsight-oauth-authorization-server.json (probed 200), openapi/gainsight-px-rest-api-openapi.yml
docs: https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/Generate_REST_API/Generate_REST_API_Key
provider: Gainsight
providerId: gainsight
provenance_note: Upgrades a 2026-07-11 derived artifact that read only the generated CS/PX scaffolds and recorded two flat apiKey schemes. Gainsight in fact operates four distinct authentication systems across three products, two of them OAuth, and publishes RFC 8414 discovery metadata.
summary:
  types:
  - oauth2
  - apiKey
  - http
  api_key_in:
  - header
  oauth_flows:
  - authorizationCode
  - clientCredentials
  pkce: true
  discovery_published: true
schemes:
- name: gainsight-cs-oauth
  surface: Gainsight CS (gainsightcloud.com) — REST, SCIM and the MCP server
  type: oauth2
  flow: authorizationCode
  pkce: S256 (required)
  authorization_endpoint: https://<tenant>.gainsightcloud.com/v1/authorize
  token_endpoint: https://<tenant>.gainsightcloud.com/v1/users/oauth/access/token
  scopes:
  - read
  - read_write
  - offline_access
  token_endpoint_auth_methods:
  - none
  - client_secret_post
  grant_types:
  - authorization_code
  - refresh_token
  discovery:
    rfc8414: /.well-known/oauth-authorization-server
    rfc9728: /.well-known/oauth-protected-resource
    status: 200
    file: ../well-known/gainsight-oauth-authorization-server.json
  level: per end user — the server enforces that user's own Gainsight permissions
  source: well-known/gainsight-oauth-authorization-server.json
- name: gainsight-cs-access-key
  surface: Gainsight CS REST API (legacy / non-OAuth path)
  type: apiKey
  in: header
  parameter: accessKey
  description: Per-tenant access key generated by a Gainsight admin. This is the key the Company, Person, CTA, Task, Success Plan, Timeline, Custom Object, Data Management and Bulk APIs document.
  source: https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/Generate_REST_API/Generate_REST_API_Key
- name: gainsight-cs-scim-m2m
  surface: Gainsight SCIM API
  type: http
  scheme: basic
  description: 'Authorization: Basic base64(client_id:client_secret) against https://<tenant>.gainsightcloud.com/v1/users/m2m/oauth/token to mint a bearer token; requests then carry Authorization: Bearer and Content-Type: application/scim+json.'
  source: https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/User_Management_APIs/SCIM_API
- name: gainsight-cc-oauth
  surface: Gainsight CC / Customer Communities (insided.com)
  type: oauth2
  flow: clientCredentials
  token_endpoint: https://api2-eu-west-1.insided.com/oauth2/token
  scopes:
  - read
  - write
  token_ttl_seconds: 7200
  description: Machine-to-machine client credentials. Gainsight notes the flow "grants the ability to act on behalf of any user on the platform" — a broad grant, and the reason moderation actions carry a separate moderatorId query parameter as a second authorization dimension.
  credential_management: Control environment > Integrations > API
  additional_authorization:
    parameter: moderatorId
    in: query
    source: https://developer-portal.gainsight.com/docs/api/authorization.md
  source: https://developer-portal.gainsight.com/docs/api/api-authentication.md
- name: gainsight-px-api-key
  surface: Gainsight PX (aptrinsic.com)
  type: apiKey
  in: header
  parameter: X-APTRINSIC-API-KEY
  description: Per-subscription API key generated under Administration > REST API. Permission flags (Read, Write, Production Launch) are attached to the key, not declared per operation in the contract.
  scopes: []
  permissions:
  - Read
  - Write
  - Production Launch
  source: openapi/gainsight-px-rest-api-openapi.yml securityDefinitions
  docs: https://support.gainsight.com/PX/API_for_Developers/02About/API_Keys
sso:
  saml: true
  note: SAML SSO is the documented single-sign-on mechanism and is a prerequisite for SCIM provisioning. OpenID Connect is NOT offered — /.well-known/openid-configuration returned 404 on every host probed.
  scim_idps_supported:
  - Okta
  - Microsoft Entra ID
assessment:
  strength: 'Gainsight CS is unusually well set up for agents: OAuth 2.1 with mandatory PKCE, per-user permission enforcement, and both RFC 8414 and RFC 9728 discovery documents served anonymously, so a client can bootstrap from a bare 401 with nothing configured but the tenant host.'
  weakness: Nothing is shared across the three products. An integration touching CS, PX and CC has to implement OAuth authorization-code, a raw API-key header and OAuth client-credentials, with three different error envelopes behind them.
docs_all:
- https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/Generate_REST_API/Generate_REST_API_Key
- https://support.gainsight.com/gainsight_nxt/01Onboarding_and_Implementation/Onboarding_for_Gainsight_NXT/Login_and_Permissions/OAuth_for_Gainsight_APIs
- https://developer-portal.gainsight.com/docs/api/api-authentication.md
- https://support.gainsight.com/PX/API_for_Developers/02About/API_Keys