Launchdarkly Authentication

specification: API Commons Authentication
specificationVersion: '0.1'
provider: LaunchDarkly
providerId: launchdarkly
generated: '2026-08-27'
method: searched
source: >-
  The Authentication section the provider maintains in info.description of
  https://app.launchdarkly.com/api/v2/openapi.json, the securitySchemes block of that
  same contract, https://launchdarkly.com/docs/home/account/api, and the RFC 8414
  metadata at https://app.launchdarkly.com/.well-known/oauth-authorization-server
  (HTTP 200, saved to well-known/).
docs: https://launchdarkly.com/docs/home/account/api
transport:
  https_required: true
  minimum_tls: '1.2'
  stated: "LaunchDarkly's REST API uses the HTTPS protocol with a minimum TLS version of 1.2."
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  primary: personal or service access token in the Authorization header
schemes:
  - name: ApiKey
    type: apiKey
    in: header
    parameter: Authorization
    scheme_prefix: none
    description: >-
      Personal or service access token, sent as the RAW value of the Authorization
      header with NO "Bearer " prefix. This is the only securityScheme declared in the
      v2 OpenAPI contract and it applies to all 401 operations.
    credential_management: https://app.launchdarkly.com/settings/authorization
    version_pinning: >-
      Each token pins an LD-API-Version at creation. See lifecycle/launchdarkly-lifecycle.yml.
    sources:
      - https://app.launchdarkly.com/api/v2/openapi.json
      - https://launchdarkly.com/docs/home/account/api
  - name: SessionCookie
    type: cookie
    description: >-
      Browser session authentication, intended for testing API calls directly from a
      logged-in browser. LaunchDarkly validates that the Origin header equals
      https://app.launchdarkly.com for cookie-authenticated calls and errors otherwise;
      token-authenticated calls are not origin-checked.
    production_use: discouraged
  - name: OAuth2
    type: oauth2
    flows: [authorization_code, refresh_token, client_credentials]
    pkce: S256
    dynamic_client_registration: https://app.launchdarkly.com/trust/oauth/register/dcr
    authorization_endpoint: https://app.launchdarkly.com/trust/oauth/authorize
    token_endpoint: https://app.launchdarkly.com/trust/oauth/token
    revocation_endpoint: https://app.launchdarkly.com/trust/oauth/revoke
    scopes: [reader, writer, observability, offline_access]
    description: >-
      Not declared in the OpenAPI contract, but real and discoverable: it backs the
      hosted MCP server and third-party integrations. Discovered by probe, not claim.
    see: scopes/launchdarkly-scopes.yml
non_api_credentials:
  note: >-
    LaunchDarkly issues three environment-scoped SDK credentials that CANNOT call the
    REST API. Attempting to do so returns 401. This distinction is the single most
    common integration mistake with this provider and the provider calls it out in bold.
  credentials:
    - name: SDK key
      used_by: Server-side SDKs
      access: Read-only, single environment, server-side SDK routes only
      secret: true
    - name: Mobile key
      used_by: Mobile SDKs
      access: Read-only, single environment, flags marked available to mobile keys
      secret: true
    - name: Client-side ID
      used_by: JavaScript-based client-side SDKs
      access: Read-only, single environment, flags marked available to client-side
      secret: false
      note: >-
        Explicitly safe to embed in untrusted contexts. It is the only LaunchDarkly
        credential the provider says may be shipped to a browser.
  rotation: >-
    Access tokens and SDK keys can be reset from the Authorization page. resetToken
    (POST /api/v2/tokens/{id}/reset) is present in the contract but marked deprecated.
authorization_model:
  roles: [Reader, Writer, Admin, Owner, custom roles]
  custom_roles:
    available: Enterprise
    syntax: resource specifiers, e.g. 'proj/{projectKey}:env/*:flag/*' with an actions list
    docs: https://launchdarkly.com/docs/home/account/roles
  scim: true
  sso: 'SAML and SSO are included on every plan per the pricing page; SCIM provisioning is Enterprise.'
network_controls:
  ip_allowlist:
    supported: true
    api: /api/v2/ip-allowlist (tag "IP Allowlist (beta)")
    docs: https://launchdarkly.com/docs/home/account/ip-allowlist
    note: Restricts access to both the LaunchDarkly app and the REST API.
agent_notes:
  - >-
    Do NOT send "Authorization: Bearer <token>". LaunchDarkly expects the bare token.
  - >-
    Always send LD-API-Version explicitly rather than relying on the token's pinned version.
  - >-
    Beta resources need "LD-API-Version: beta" or they return 403 — which looks like a
    permission failure but is a header failure.