Jit (fka Cbrix) · Authentication Profile

Jit Fka Cbrix Authentication

Authentication

Jit (fka Cbrix) secures its APIs with oauth2 and http across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials, authorizationCode, deviceCode, tokenExchange, and refreshToken flow(s).

CompanyCybersecurityApplication SecurityDevSecOpsASPMSecurityVulnerability Management

Methods: oauth2, http Schemes: 2 OAuth flows: clientCredentials, authorizationCode, deviceCode, tokenExchange, refreshToken API key in:

Security Schemes

BearerJWT http

scheme: bearer

OAuth2 oauth2

· flows: clientCredentials, authorizationCode, deviceCode

Source

Authentication Profile

generated: '2026-07-19'
method: searched
source: https://docs.jit.io/reference/credentials
docs: https://docs.jit.io/docs/managing-users
discovery: https://auth.jit.io/.well-known/openid-configuration
summary:
  types:
  - oauth2
  - http
  http_schemes:
  - bearer
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  - deviceCode
  - tokenExchange
  - refreshToken
  bearer_format: JWT
schemes:
- name: BearerJWT
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: >-
    API requests to api.jit.io are authorized with a Bearer JWT. Clients obtain the
    JWT by POSTing their Client ID and Secret to the credentials endpoint
    (https://api.jit.io/authentication/login). The issued token is valid for 24
    hours, after which the client must re-authenticate.
  sources:
  - https://docs.jit.io/reference/credentials
- name: OAuth2
  type: oauth2
  description: >-
    Jit runs a full OAuth2 / OpenID Connect authorization server at auth.jit.io.
    Machine-to-machine API access uses the client_credentials grant (Client ID +
    Secret issued under Settings -> Users & Permissions -> API Tokens). Interactive
    and device flows are also supported.
  authorization_server: https://auth.jit.io
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.jit.io/oauth/token
  - flow: authorizationCode
    authorizationUrl: https://auth.jit.io/oauth/authorize
    tokenUrl: https://auth.jit.io/oauth/token
    pkce: S256
  - flow: deviceCode
    deviceAuthorizationUrl: https://auth.jit.io/oauth/device/authorize
    tokenUrl: https://auth.jit.io/oauth/token
  grant_types_supported:
  - authorization_code
  - refresh_token
  - client_credentials
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:ietf:params:oauth:grant-type:device_code
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  id_token_signing_alg:
  - RS256
  - ES256
  registration_endpoint: https://auth.jit.io/oauth/dcr/register
  sources:
  - https://auth.jit.io/.well-known/openid-configuration
roles:
  description: >-
    API tokens are created against a user role; the token inherits that role's
    permissions.
  values:
  - Admin
  - Engineering Manager
  - Member
  - Developer

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/jit-fka-cbrix-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.