Kana Authentication

generated: '2026-08-13'
method: probed
source: https://apps.kana.ai/.well-known/oauth-authorization-server
docs: null
host: https://apps.kana.ai
summary: >-
  Kana's application host runs two distinct authentication models side by side: an
  OAuth 2.0 authorization server (RFC 8414 metadata served anonymously, PKCE-only,
  with RFC 7591 dynamic client registration) that fronts the platform's MCP server,
  and a simple API-key header for the Skill API that a deployed Kana pipeline exposes.
schemes:
- id: oauth2
  type: oauth2
  spec: RFC 6749 + RFC 8414 (metadata) + RFC 7636 (PKCE) + RFC 7591 (DCR)
  issuer: https://apps.kana.ai
  flows:
    authorization_code:
      authorization_url: https://apps.kana.ai/oauth/authorize
      token_url: https://apps.kana.ai/oauth/token
      refresh_url: https://apps.kana.ai/oauth/token
      scopes:
      - mcp:read
      - mcp:write
      - kana:read
      - kana:write
  grant_types_supported:
  - authorization_code
  - refresh_token
  code_challenge_methods_supported:
  - S256
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  - none
  registration_endpoint: https://apps.kana.ai/oauth/register
  introspection_endpoint: https://apps.kana.ai/oauth/introspect
  revocation_endpoint: https://apps.kana.ai/oauth/revoke
  dynamic_client_registration: true
  public_clients_supported: true
  note: >-
    token_endpoint_auth_methods_supported includes "none", and only S256 PKCE is
    offered — the shape an MCP client uses. The metadata additionally carries
    "mcp_protocol_version": "2025-03-26".
  evidence:
    url: https://apps.kana.ai/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json; charset=utf-8
    fetched: '2026-08-13'
- id: apikey
  type: apiKey
  in: header
  name: x-kana-apikey
  applies_to: Kana Skill API (POST /skill/{pipelineid}, /run/*, /file_ul, /file_dl/*)
  method: derived
  source: https://apps.kana.ai/index.js
  note: >-
    Read from the OpenAPI 3.0.3 document Kana's own console bundle generates for a
    deployed skill (info.title "Kana API"; components.securitySchemes.apikey =
    {type: apiKey, in: header, name: x-kana-apikey}; every operation carries
    security: [{apikey: []}] and a documented 401 "Invalid apikey specified").
    The generated document is rendered in a Swagger UI inside the signed-in console;
    it is not published at a public URL, so no spec was saved to openapi/.
  evidence:
    url: https://apps.kana.ai/index.js
    http_status: 200
    fetched: '2026-08-13'
gated: true
gate_note: >-
  API keys are issued from the signed-in Kana console (apps.kana.ai); there is no
  public developer portal, no anonymous key issuance, and no public auth documentation
  page. Every apps.kana.ai path except the OAuth metadata answers 401.