Kubb Studio · Authentication Profile

Kubb Studio Authentication

Authentication

Kubb publishes no HTTP API contract for Kubb Studio. The documented credentials are those the kubb CLI and git use against kubb.studio; the Kubb Extension Registry (https://kubb.dev/registry) is public static JSON with no authentication.

Kubb Studio declares 4 security scheme(s) across its OpenAPI definitions.

CompanyCode GenerationOpenAPITypeScriptSDK GenerationDeveloper ToolsAPI ClientZodTanStack QueryMocking

Methods: Schemes: 4 OAuth flows: API key in:

Security Schemes

device-pairing pairing-code

organization-ci-api-key apiKey

· in: cli-flag / environment (KUBB_TOKEN (or --token=))

ai-key http

scheme: basic

registry-public none

Source

Authentication Profile

generated: '2026-11-06'
method: searched
source: https://kubb.dev/docs/5.x/reference/commands/studio
docs: https://kubb.dev/docs/5.x/integrations/studio
description: Kubb publishes no HTTP API contract for Kubb Studio. The documented credentials are those the kubb CLI and git use against kubb.studio; the Kubb Extension Registry (https://kubb.dev/registry)
  is public static JSON with no authentication.
schemes:
- name: device-pairing
  type: pairing-code
  description: kubb studio shows a pairing code that a user approves in the Studio window; the CLI then stores a per-project token (forgotten by kubb studio logout). The Docker agent is approved by an organization
    admin.
  source: https://kubb.dev/docs/5.x/reference/commands/studio
- name: organization-ci-api-key
  type: apiKey
  in: cli-flag / environment
  parameter: KUBB_TOKEN (or --token=<key>)
  description: Organization CI API key used only by kubb studio snapshot.
  source: https://kubb.dev/docs/5.x/reference/commands
- name: ai-key
  type: http
  scheme: basic
  description: Token of type AI (read-only), created under Settings › Developers › Tokens, used as the git password for the plugin marketplace at https://kubb.studio/plugins/<organization-slug>.git; any
    username works. A registry key does not work here. Pro plan.
  source: https://kubb.dev/docs/5.x/integrations/studio
- name: registry-public
  type: none
  description: Registry documents are served as application/json with CORS allowed and no authentication.
  source: https://kubb.dev/docs/5.x/reference/registry

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/kubb-studio-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.