Gainsight Authentication

generated: '2026-09-17'
method: searched
source: >-
  https://developer-portal.gainsight.com/docs/api/api-authentication.md,
  https://support.gainsight.com/gainsight_nxt/01Onboarding_and_Implementation/Onboarding_for_Gainsight_NXT/Login_and_Permissions/OAuth_for_Gainsight_APIs,
  https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/User_Management_APIs/SCIM_API,
  well-known/gainsight-oauth-authorization-server.json (probed 200),
  openapi/gainsight-px-rest-api-openapi.yml
docs:
  - https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/Generate_REST_API/Generate_REST_API_Key
  - https://support.gainsight.com/gainsight_nxt/01Onboarding_and_Implementation/Onboarding_for_Gainsight_NXT/Login_and_Permissions/OAuth_for_Gainsight_APIs
  - https://developer-portal.gainsight.com/docs/api/api-authentication.md
  - https://support.gainsight.com/PX/API_for_Developers/02About/API_Keys
provider: Gainsight
providerId: gainsight
provenance_note: >-
  Upgrades a 2026-07-11 derived artifact that read only the generated CS/PX
  scaffolds and recorded two flat apiKey schemes. Gainsight in fact operates four
  distinct authentication systems across three products, two of them OAuth, and
  publishes RFC 8414 discovery metadata.

summary:
  types: [oauth2, apiKey, http]
  api_key_in: [header]
  oauth_flows: [authorizationCode, clientCredentials]
  pkce: true
  discovery_published: true

schemes:
  - name: gainsight-cs-oauth
    surface: Gainsight CS (gainsightcloud.com) — REST, SCIM and the MCP server
    type: oauth2
    flow: authorizationCode
    pkce: S256 (required)
    authorization_endpoint: https://<tenant>.gainsightcloud.com/v1/authorize
    token_endpoint: https://<tenant>.gainsightcloud.com/v1/users/oauth/access/token
    scopes: [read, read_write, offline_access]
    token_endpoint_auth_methods: [none, client_secret_post]
    grant_types: [authorization_code, refresh_token]
    discovery:
      rfc8414: /.well-known/oauth-authorization-server
      rfc9728: /.well-known/oauth-protected-resource
      status: 200
      file: ../well-known/gainsight-oauth-authorization-server.json
    level: per end user — the server enforces that user's own Gainsight permissions
    source: well-known/gainsight-oauth-authorization-server.json

  - name: gainsight-cs-access-key
    surface: Gainsight CS REST API (legacy / non-OAuth path)
    type: apiKey
    in: header
    parameter: accessKey
    description: >-
      Per-tenant access key generated by a Gainsight admin. This is the key the
      Company, Person, CTA, Task, Success Plan, Timeline, Custom Object, Data
      Management and Bulk APIs document.
    source: https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/Generate_REST_API/Generate_REST_API_Key

  - name: gainsight-cs-scim-m2m
    surface: Gainsight SCIM API
    type: http
    scheme: basic
    description: >-
      Authorization: Basic base64(client_id:client_secret) against
      https://<tenant>.gainsightcloud.com/v1/users/m2m/oauth/token to mint a
      bearer token; requests then carry Authorization: Bearer and
      Content-Type: application/scim+json.
    source: https://support.gainsight.com/gainsight_nxt/API_and_Developer_Docs/User_Management_APIs/SCIM_API

  - name: gainsight-cc-oauth
    surface: Gainsight CC / Customer Communities (insided.com)
    type: oauth2
    flow: clientCredentials
    token_endpoint: https://api2-eu-west-1.insided.com/oauth2/token
    scopes: [read, write]
    token_ttl_seconds: 7200
    description: >-
      Machine-to-machine client credentials. Gainsight notes the flow "grants the
      ability to act on behalf of any user on the platform" — a broad grant, and
      the reason moderation actions carry a separate moderatorId query parameter
      as a second authorization dimension.
    credential_management: Control environment > Integrations > API
    additional_authorization:
      parameter: moderatorId
      in: query
      source: https://developer-portal.gainsight.com/docs/api/authorization.md
    source: https://developer-portal.gainsight.com/docs/api/api-authentication.md

  - name: gainsight-px-api-key
    surface: Gainsight PX (aptrinsic.com)
    type: apiKey
    in: header
    parameter: X-APTRINSIC-API-KEY
    description: >-
      Per-subscription API key generated under Administration > REST API.
      Permission flags (Read, Write, Production Launch) are attached to the key,
      not declared per operation in the contract.
    scopes: []
    permissions: [Read, Write, Production Launch]
    source: openapi/gainsight-px-rest-api-openapi.yml securityDefinitions
    docs: https://support.gainsight.com/PX/API_for_Developers/02About/API_Keys

sso:
  saml: true
  note: >-
    SAML SSO is the documented single-sign-on mechanism and is a prerequisite for
    SCIM provisioning. OpenID Connect is NOT offered —
    /.well-known/openid-configuration returned 404 on every host probed.
  scim_idps_supported: [Okta, Microsoft Entra ID]

assessment:
  strength: >-
    Gainsight CS is unusually well set up for agents: OAuth 2.1 with mandatory
    PKCE, per-user permission enforcement, and both RFC 8414 and RFC 9728
    discovery documents served anonymously, so a client can bootstrap from a bare
    401 with nothing configured but the tenant host.
  weakness: >-
    Nothing is shared across the three products. An integration touching CS, PX
    and CC has to implement OAuth authorization-code, a raw API-key header and
    OAuth client-credentials, with three different error envelopes behind them.