Klang Games · Authentication Profile

Klang Authentication

Authentication

Klang Games secures its APIs with oauth2 and openIdConnect across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, implicit, password, clientCredentials, deviceCode, and refreshToken flow(s).

CompanyConsumerGamingGame DevelopmentMMOSimulationEntertainmentIdentityOpenID ConnectBerlin
Methods: oauth2, openIdConnect Schemes: 2 OAuth flows: authorizationCode, implicit, password, clientCredentials, deviceCode, refreshToken API key in:

Security Schemes

SEEDOpenIDConnect openIdConnect
SEEDOAuth2 oauth2
· flows: authorizationCode, implicit, password, clientCredentials, deviceCode

Source

Authentication Profile

klang-authentication.yml Raw ↑ 
generated: '2026-07-19'
method: searched
source: https://seed.game/.well-known/openid-configuration
docs: https://seed.game/login
summary:
  types:
  - oauth2
  - openIdConnect
  oauth2_flows:
  - authorizationCode
  - implicit
  - password
  - clientCredentials
  - deviceCode
  - refreshToken
  api_key_in: []
  note: >-
    Klang publishes no developer-facing authentication documentation. This
    profile is read verbatim from the OpenID Connect discovery documents served
    for the SEED player account system. The endpoint shape (oauth2/authorize,
    oauth2/device_authorize, applicationId + authenticationType claims)
    identifies the identity provider as FusionAuth.
schemes:
- name: SEEDOpenIDConnect
  type: openIdConnect
  openIdConnectUrl: https://seed.game/.well-known/openid-configuration
  issuer: https://seed.game
  sources:
  - well-known/klang-openid-configuration.json
- name: SEEDOAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.seed.game/oauth2/authorize
    tokenUrl: https://login.seed.game/oauth2/token
  - flow: implicit
    authorizationUrl: https://login.seed.game/oauth2/authorize
  - flow: password
    tokenUrl: https://login.seed.game/oauth2/token
  - flow: clientCredentials
    tokenUrl: https://login.seed.game/oauth2/token
  - flow: deviceCode
    deviceAuthorizationUrl: https://login.seed.game/oauth2/device_authorize
    tokenUrl: https://login.seed.game/oauth2/token
  sources:
  - well-known/klang-openid-configuration.json
endpoints:
  authorization: https://login.seed.game/oauth2/authorize
  token: https://login.seed.game/oauth2/token
  device_authorization: https://login.seed.game/oauth2/device_authorize
  userinfo: https://login.seed.game/oauth2/userinfo
  end_session: https://login.seed.game/oauth2/logout
  jwks: https://login.seed.game/.well-known/jwks.json
token_endpoint_auth_methods:
- client_secret_basic
- client_secret_post
- none
id_token_signing_alg_values:
- ES256
- ES384
- ES512
- HS256
- HS384
- HS512
- RS256
- RS384
- RS512
claims_supported:
- applicationId
- at_hash
- aud
- authenticationType
- birthdate
- c_hash
- email
- email_verified
- exp
- family_name
- given_name
- iat
- iss
- jti
- middle_name
- name
- nbf
- nonce
- phone_number
- phone_number_verified
- picture
- preferred_username
- roles
- sub
observations:
- >-
  The discovery document at https://login.seed.game/ reports issuer "acme.com",
  the unchanged FusionAuth default placeholder, while the document at
  https://seed.game/ reports the correct issuer https://seed.game. A relying
  party validating the iss claim against the login host would reject tokens.
- >-
  Both the implicit and resource-owner-password grants remain enabled; RFC 9700
  (OAuth 2.0 Security Best Current Practice) advises against both.
- >-
  Symmetric HS256/HS384/HS512 are advertised as ID-token signing algorithms
  alongside the asymmetric families.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/klang-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.