Laurence · Authentication Profile

Laurence Authentication

Authentication

Laurence's only publicly documented programmatic surface is its hosted MCP server, which is an OAuth 2.0 protected resource. The authorization server is www.laurence.com; the protected resource is the MCP endpoint on modal.run. The flow is authorization code with PKCE (S256 only) and supports OAuth 2.0 Dynamic Client Registration — token_endpoint_auth_methods_supported is "none", i.e. public clients only, which is what lets an IDE register itself and complete a browser sign-in without any pre-issued credential. There is no documented API-key or HTTP-basic surface, and no general-purpose REST API is published.

Laurence declares 1 security scheme(s) across its OpenAPI definitions.

CompanyAdvertisingAmazonE-CommerceMarketingMachine-LearningRetail MediaMCP

Methods: Schemes: 1 OAuth flows: API key in:

Security Schemes

laurence_mcp_oauth oauth2

Source

Authentication Profile

generated: '2026-08-13'
method: searched
source: >-
  https://www.laurence.com/.well-known/openid-configuration,
  https://www.laurence.com/.well-known/oauth-authorization-server,
  https://laurence-ai-68564--ask-laurence-agent-mcp-server.modal.run/.well-known/oauth-protected-resource,
  https://www.laurence.com/blog/laurence-mcp-launch
docs: https://www.laurence.com/blog/laurence-mcp-launch
description: >-
  Laurence's only publicly documented programmatic surface is its hosted MCP server, which is an
  OAuth 2.0 protected resource. The authorization server is www.laurence.com; the protected resource
  is the MCP endpoint on modal.run. The flow is authorization code with PKCE (S256 only) and
  supports OAuth 2.0 Dynamic Client Registration — token_endpoint_auth_methods_supported is "none",
  i.e. public clients only, which is what lets an IDE register itself and complete a browser sign-in
  without any pre-issued credential. There is no documented API-key or HTTP-basic surface, and no
  general-purpose REST API is published.
schemes:
  - name: laurence_mcp_oauth
    type: oauth2
    flow: authorizationCode
    issuer: https://www.laurence.com
    authorization_url: https://www.laurence.com/api/mcp/oauth/authorize
    token_url: https://www.laurence.com/api/mcp/oauth/token
    registration_url: https://www.laurence.com/api/mcp/oauth/register
    jwks_uri: https://www.laurence.com/.well-known/jwks.json
    jwks_status: 503
    pkce:
      required: true
      code_challenge_methods:
        - S256
    grant_types:
      - authorization_code
      - refresh_token
    response_types:
      - code
    token_endpoint_auth_methods:
      - none
    client_registration: dynamic
    subject_types:
      - public
    bearer_methods:
      - header
    scopes:
      - openid
      - profile
      - email
      - laurence:mcp
    applies_to:
      - https://mcp.laurence.com/mcp
      - https://laurence-ai-68564--ask-laurence-agent-mcp-server.modal.run/mcp
authorization_model:
  tenancy: >-
    Every tool call is scoped to the Amazon Ads profiles the signed-in user belongs to. Callers pass
    a profile_id and the server returns only data that user is permitted to see.
  discovery_tool: list_allowed_ads_profiles
  access: Laurence customers only
  read_only: true
observed:
  probed: '2026-08-13'
  unauthenticated_request_status: 401
  challenge: >-
    WWW-Authenticate: Bearer error="invalid_token", error_description="Authentication required",
    resource_metadata="https://mcp.laurence.com/.well-known/oauth-protected-resource/mcp"
  change_since_2026_07_19: >-
    The protected-resource metadata and the 401 challenge now name the first-party branded host
    https://mcp.laurence.com/mcp as the resource, replacing the modal.run deployment URL. The
    OAuth authorization server, endpoints, scopes and PKCE requirements are unchanged. The
    advertised jwks_uri still returns HTTP 503, so ID-token signatures remain unverifiable.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/laurence-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.