STACK Authentication

generated: '2026-11-10'
method: searched
generator: extract-docs-artifacts.py (local)
source: https://getstack.run/docs/api/authentication
sources:
- https://getstack.run/docs/api/authentication
- https://getstack.run/docs/security/mcp-auth-troubleshooting
- https://getstack.run/docs/getting-started
- https://getstack.run/docs/security/mcp-setup
description: Authentication methods described in STACK documentation
schemes:
- type: http-bearer
  name: Operator token
  evidence: 'Authorization Header text Authorization: Bearer $STACK_TOKEN'
  location: header
  header: Authorization
- type: http-bearer
  name: OAuth access token
  evidence: MCP clients, the CLI and other authorized integrations use short-lived OAuth access tokens.
  location: header
  header: Authorization
  how_to_obtain: Obtain via OAuth flow as described in MCP setup and discovery endpoints
- type: http-bearer
  name: Agent JWT
  evidence: Customer-managed agents enroll a public key and exchange a signed challenge for a short-lived agent JWT.
  location: header
  header: Authorization
  how_to_obtain: Enroll agent with public key and receive JWT after challenge exchange
- type: other
  name: Passport token
  evidence: Send it in X-Passport-Token when a route requires it.
  location: header
  header: X-Passport-Token
  how_to_obtain: Generated as a passport proving agent identity and delegated scope
note: OAuth flow details (authorize/token URLs, scopes) are not explicitly listed in the provided pages, so they are omitted. 1 extracted row(s)
  were dropped because their quote was not on the page.
docs: https://getstack.run/docs/api/authentication