Klue Authentication

generated: '2026-08-14'
method: searched
source: https://klue.com/blog/how-to-connect-klue-to-chatgpt
docs: https://help.app.klue.com/
docs_note: >-
  help.app.klue.com is customer-only — every path below the root 302s to
  /account/signin — so the Content API reference itself is not publicly readable.
summary:
  types: [apiKey, oauth2, openIdConnect]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
  oauth2_discovery: https://app.klue.com/.well-known/openid-configuration
  scopes_published: 23
  note: >-
    Klue publishes no OpenAPI document publicly; the Content API OpenAPI schema is
    distributed inside the authenticated application under
    Apps & Integrations > Content API > "How to use". The apiKey profile is
    therefore searched from Klue's public documentation rather than derived from a
    spec. The oauth2/openIdConnect profile, added 2026-08-14, is PROBED: Klue's
    application host serves a real OpenID Connect Discovery / RFC 8414 document
    anonymously at HTTP 200, which is the first machine-readable contract found on
    Klue's public surface.
schemes:
- name: klue-content-api-key
  type: apiKey
  in: header
  parameter_name: Authorization
  scheme_hint: bearer
  description: >-
    A Klue API key passed as a Bearer token. Klue's own ChatGPT setup guide
    instructs users to select "API Key" with "Bearer" as the auth type and paste
    the Klue API key.
  applies_to:
  - Klue Content API
  - Klue MCP Server
  sources:
  - https://klue.com/blog/how-to-connect-klue-to-chatgpt
- name: klue-oauth2
  type: oauth2
  method: probed
  description: >-
    Klue runs an OAuth 2.0 authorization server on its application host, disclosed
    through an anonymous OpenID Connect Discovery document. Authorization code
    grant with refresh tokens and PKCE (S256), client_secret_basic or
    client_secret_post client authentication, and RFC 7591 dynamic client
    registration. Klue publishes no prose documentation for this surface — it is
    only visible through the discovery document.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.klue.com/oauth/authorize
    tokenUrl: https://app.klue.com/oauth/token
    refreshUrl: https://app.klue.com/oauth/token
    scopes_count: 23
  pkce:
    supported: true
    methods: [S256, plain]
  dynamic_client_registration:
    supported: true
    standard: RFC 7591
    endpoint: https://app.klue.com/oauth/register
    probe: >-
      An anonymous POST with a deliberately invalid redirect_uri returned HTTP 400
      invalid_redirect_uri, confirming the endpoint is live and validating input
      rather than 404ing. No client was registered.
  token_management:
    revocation_endpoint: https://app.klue.com/oauth/revoke
    introspection_endpoint: https://app.klue.com/oauth/introspect
  detail: scopes/klue-scopes.yml
  applies_to:
  - Klue MCP Server
  - Klue integrations (Slack, Teams, CRM, SCIM)
  sources:
  - https://app.klue.com/.well-known/openid-configuration
  - well-known/klue-openid-configuration.json
- name: klue-openid-connect
  type: openIdConnect
  method: probed
  openIdConnectUrl: https://app.klue.com/.well-known/openid-configuration
  description: >-
    OpenID Connect provider on the same issuer. RS256 ID token signing, pairwise
    subject identifiers, userinfo endpoint, JWKS at /oauth/discovery/keys
    (verified live, returns an RSA key set).
  claims_supported: [iss, sub, aud, exp, iat]
  id_token_signing_alg_values_supported: [RS256]
  subject_types_supported: [pairwise]
  sources:
  - https://app.klue.com/.well-known/openid-configuration
key_management:
  console_path: Apps & Integrations > Content API > Manage API Keys
  requires_role: Admin
  create: Create New API Key
  named_keys: true
  expiration:
    supported: true
    user_selected: true
    vendor_recommendation: 1 year for production use
  rotation_note: >-
    Keys are named and carry a user-selected expiry, so rotation is
    self-service. Klue's guidance is to treat the key like a password.
sso:
  supported: true
  protocols: [SAML 2.0]
  identity_providers:
  - name: Okta
    url: https://www.okta.com/integrations/klue/
  - name: Microsoft Entra ID
    url: https://learn.microsoft.com/en-us/entra/identity/saas-apps/klue-tutorial
  source: https://klue.com/product/security
access_control:
  role_based_access: true
  customized_user_permissions: true
  source: https://klue.com/product/security