Klutch Authentication

generated: '2026-07-19'
method: searched
source: https://api-docs.klutchcard.com/ (Klutch Public API Postman collection),
  well-known/klutch-graphql-oauth-authorization-server.json,
  https://github.com/KlutchCard/api-samples
docs: https://www.klutchcard.com/developer
summary:
  types: [http, oauth2]
  http_schemes: [bearer]
  bearer_sources: [session-token-mutation, oauth2-authorization-code]
  oauth2_flows: [authorizationCode]
  api_key_in: []
  dynamic_client_registration: true
  pkce: S256
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  in: header
  parameter: Authorization
  description: >-
    Every Klutch GraphQL call carries `Authorization: Bearer <token>`. The
    collection-level auth in the published Postman collection is bearer.
  sources: [postman/klutch-public-api-postman.json]
- name: sessionToken
  type: credentials-exchange
  description: >-
    Developers exchange a client id and secret key for a session bearer token with
    the `createSessionToken` mutation, then send that token as the bearer on
    subsequent calls. Credentials are issued from the Klutch developer area
    ("My Account" -> "Developers") and are supplied to the samples as
    KLUTCH_CLIENT_ID / KLUTCH_SECRET_KEY environment variables.
  operation: 'mutation($clientId: String, $secretKey: String) { createSessionToken(clientId:
    $clientId, secretKey: $secretKey) }'
  sources: [postman/klutch-public-api-postman.json, 'https://github.com/KlutchCard/api-samples']
- name: oauth2
  type: oauth2
  description: >-
    Klutch runs an OAuth 2.1 authorization server in front of each API host, advertised
    via RFC 8414 metadata. Authorization code with PKCE only (S256), public clients
    (token_endpoint_auth_methods_supported is "none"), with RFC 7591 dynamic client
    registration. This is the flow user-consented agents (including the Klutch MCP
    server) use. The underlying identity provider is Amazon Cognito.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://graphql.klutchcard.com/oauth/authorize
    tokenUrl: https://graphql.klutchcard.com/oauth/token
    registrationUrl: https://graphql.klutchcard.com/oauth/register
    revocationUrl: https://auth.klutch.cards/oauth2/revoke
    userinfoUrl: https://auth.klutch.cards/oauth2/userInfo
    endSessionUrl: https://auth.klutch.cards/logout
    scopes: [openid, email, phone, profile]
  issuer: https://cognito-idp.us-west-2.amazonaws.com/us-west-2_LSWgwjdrS
  jwks_uri: https://cognito-idp.us-west-2.amazonaws.com/us-west-2_LSWgwjdrS/.well-known/jwks.json
  id_token_signing_alg_values_supported: [RS256]
  sources: [well-known/klutch-graphql-oauth-authorization-server.json]
- name: miniappJwt
  type: jwt-assertion
  description: >-
    Mini Apps are registered with a developer-generated key pair (`klutch generateKey`
    in the CLI) and sign a JWT to obtain a miniapp access token; that token mints a
    per-install token via `recipeInstall(id:) { createToken }`, which is the bearer
    used for panel mutations on behalf of an installing user.
  tokens:
  - miniapp_access_token
  - recipeinstall_token
  sources: [postman/klutch-public-api-postman.json, cli/klutch-cli.yml]
environments:
- name: production
  endpoint: https://graphql.klutchcard.com/graphql
  audience: a user acting on their own data
- name: sandbox
  endpoint: https://sandbox.klutchcard.com/graphql
  audience: Mini App developers testing from a multi-user perspective