Kolide · Authentication Profile

Kolide Authentication

Authentication

Kolide secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanyB2BSecurityDevice TrustEndpoint SecurityZero TrustComplianceIdentityosqueryDevice Management
Methods: http Schemes: 1 OAuth flows: API key in:

Security Schemes

api_key http
scheme: bearer · in: header ()

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-19'
method: searched
source:
- https://www.kolide.com/docs/developers/api
- openapi/kolide-k2-openapi.json
- openapi/kolide-k2-2023-05-26-openapi.json
docs: https://www.kolide.com/docs/developers/api
api: K2 API
base_url: https://api.kolide.com
summary:
  types: [http]
  model: static bearer API keys — no OAuth authorization server, no scopes, no OIDC
schemes:
- name: api_key
  type: http
  scheme: bearer
  in: header
  header: Authorization
  format: 'Authorization: Bearer $KOLIDE_API_TOKEN'
  applied: 'globally via root-level security [{api_key: []}] on all 65 operations'
  sources:
  - openapi/kolide-k2-openapi.json
  - openapi/kolide-k2-2023-05-26-openapi.json
  token:
    shape: $PREFIX_$VERSION_$SECRET
    prefix: k2sk
    version_segment: v1
    example_documented_by_provider: k2sk_v1_A2UYhW7OPt2jKKLqmFcaGNK7
    rotation: manual, via the admin dashboard
    expiry: not documented
  provisioning:
    ui_path: Settings > Developers > API Keys
    required_role: administrator
  authorization:
    model: per-key permissions
    read: available to all plans
    write: >-
      Available exclusively to Kolide Max subscribers. Write access must be granted
      explicitly per key and requires a documented rationale at creation time.
    scopes: none — Kolide does not expose an OAuth scope surface
secondary_credentials:
- name: SSF poll bearer token
  header: X-Kolide-Poll-Bearer-Token
  applies_to: SSF stream polling (RFC 8936)
  rotation: 'POST /ssf_streams/{id}/rotate_poll_token with overlap | immediate | disable modes'
  source: https://www.kolide.com/docs/developers/ssf-streams
- name: webhook signing secret
  header: Authorization
  algorithm: HMAC-SHA256 hex digest over the raw request body
  applies_to: inbound webhook verification
  source: https://www.kolide.com/docs/developers/webhooks
related_headers:
- name: X-Kolide-Api-Version
  purpose: Pin the dated API version line (current 2026-04-07); optional, defaults to latest
gaps:
- No OAuth 2.0 or OpenID Connect support; no /.well-known/oauth-authorization-server or
  /.well-known/openid-configuration (both 404).
- No scope surface — permissions are coarse per-key grants, not delegatable scopes.
- No documented token expiry or automated rotation for the primary k2sk API key.
- No mutual TLS or request-signing option for API calls.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/kolide-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.