Gitee · Authentication Profile

Gitee Authentication

Authentication

Gitee secures its APIs with apiKey, http, and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions.

Code HostingGitGit HostingVersion ControlRepositoriesPull RequestsIssue TrackingDevOpsOpen-SourceChina
Methods: apiKey, http, oauth2 Schemes: 3 OAuth flows: API key in:

Security Schemes

accessTokenQuery apiKey
· in: query ()
bearerAuth http
scheme: bearer
oauth2 oauth2

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-12'
method: probed
source: live Swagger swagger_doc.json + Gitee OAuth documentation
summary:
  types:
  - apiKey
  - http
  - oauth2
schemes:
- name: accessTokenQuery
  type: apiKey
  in: query
  parameterName: access_token
  description: >-
    Personal access token supplied as the `access_token` query parameter. This
    is the predominant auth style in the Gitee Open API v5 - it is present on
    236 of 264 operations in the live Swagger definition. Create a token under
    Gitee account Settings > Private tokens.
  sources:
  - https://gitee.com/api/v5/swagger_doc.json
- name: bearerAuth
  type: http
  scheme: bearer
  description: >-
    The same personal access token may be sent as an
    `Authorization: Bearer <token>` request header instead of a query
    parameter.
  sources:
  - https://gitee.com/api/v5/swagger
- name: oauth2
  type: oauth2
  flow: authorizationCode
  authorizationUrl: https://gitee.com/oauth/authorize
  tokenUrl: https://gitee.com/oauth/token
  refreshUrl: https://gitee.com/oauth/token
  scopes:
  - user_info
  - projects
  - pull_requests
  - issues
  - notes
  - keys
  - hook
  - groups
  - gists
  - enterprises
  - emails
  description: >-
    Gitee OAuth2 for third-party applications. Register an application to obtain
    a client id and secret, direct users to the authorize endpoint, and exchange
    the returned code at the token endpoint (refresh tokens are issued).
    The authorize endpoint was confirmed live (HTTP 302) on 2026-07-12. The
    scope list is drawn from Gitee's OAuth documentation; the Swagger definition
    itself carries no securityDefinitions.
  sources:
  - https://gitee.com/api/v5/oauth_doc
notes: >-
  Unauthenticated requests are allowed for public reads at a reduced rate limit
  (60 requests/minute, confirmed via live X-RateLimit-Limit response header).
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/gitee-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.