Jotform Authentication

generated: '2026-11-05'
method: searched
source:
- https://api.jotform.com/docs/#authentication
- https://www.jotform.com/developers/tools/
- https://www.jotform.com/developers/mcp/?tab=mcp
- https://mcp.jotform.com/.well-known/oauth-authorization-server
docs: https://api.jotform.com/docs/#authentication
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  - query
  statement: 'The Jotform API supports more than one authentication method: the API key as the apiKey query parameter,
    the API key as the APIKEY HTTP header, or the JavaScript SDK (JF.login) which obtains a key on the user''s behalf
    with accessType readOnly or full. The MCP server uses OAuth 2.0 only.'
schemes:
- name: ApiKeyHeader
  type: apiKey
  in: header
  parameter: APIKEY
  docs: https://api.jotform.com/docs/#authentication
  evidence: 'curl -H "APIKEY: {myApiKey}" "https://api.jotform.com/user"'
  key_issuance: My Account -> API Section -> Create a new API Key
  sources:
  - https://api.jotform.com/docs/
  - openapi/jotform-user-api-openapi.yml
- name: ApiKeyQuery
  type: apiKey
  in: query
  parameter: apiKey
  docs: https://api.jotform.com/docs/#authentication
  evidence: curl -X GET "https://api.jotform.com/user?apiKey={myApiKey}"
  sources:
  - https://api.jotform.com/docs/
  - openapi/jotform-user-api-openapi.yml
- name: JavascriptSdkLogin
  type: sdk-login
  in: browser
  parameter: null
  docs: https://www.jotform.com/developers/tools/
  evidence: 'JF.initialize({ accessType: "readOnly" | "full" }); JF.login(success, error); JF.getAPIKey()'
  note: https://js.jotform.com/JotForm.min.js launches a Jotform login in an iframe and hands the app a user API
    key with readOnly or full access.
  sources:
  - https://www.jotform.com/developers/tools/
  - https://api.jotform.com/docs/#authentication
- name: MCPOAuth2
  type: oauth2
  flow: authorizationCode
  authorizationUrl: https://oauth2.jotform.com/authorize
  tokenUrl: https://oauth2.jotform.com/token
  revocationUrl: https://oauth2.jotform.com/revoke
  registrationUrl: https://oauth2.jotform.com/register-public-client
  pkce: S256
  scopes:
    readOnly: read access to the user's Jotform data (scope name as published)
    full: full access (scope name as published)
  applies_to: https://mcp.jotform.com and its product servers only
  docs: https://www.jotform.com/developers/mcp/?tab=mcp
  evidence: 'Authentication: OAuth 2.0 authorization code flow with PKCE (S256). Each user approves access once
    on the Jotform consent screen. Jotform API keys are not accepted.'
  sources:
  - https://www.jotform.com/developers/mcp/?tab=mcp
  - https://mcp.jotform.com/.well-known/oauth-authorization-server
  - https://mcp.jotform.com/.well-known/oauth-protected-resource
enterprise_note: Upgrade to Enterprise to make your API url your-domain.com/API or subdomain.jotform.com/API instead
  of api.jotform.com (api.jotform.com/docs).