Leena Ai Authentication

generated: '2026-07-19'
method: searched
docs: https://docs.leena.ai/docs/external-aop-api-authentication-usage-guide
sources:
  - https://docs.leena.ai/docs/external-aop-api-authentication-usage-guide
  - https://docs.leena.ai/docs/audit-logs-external-api-authentication-usage-guide-beta
  - https://docs.leena.ai/docs/rest
  - https://docs.leena.ai/docs/leena-ai-mcp-server
summary: >-
  Leena AI's external APIs authenticate with OAuth 2.0 using the resource owner password
  credentials grant. The client authenticates to the regional ACL token endpoint with HTTP
  Basic (base64 of clientId:clientSecret) and posts a username, password and
  grant_type=password. The response carries a Bearer access token, a refresh token, and an
  expires_in of 3600 seconds. Credentials are issued by a Leena AI representative or, for
  MCP/A2A, self-generated from Orchestrator Settings. There is no public self-service
  signup for API credentials.
schemes:
  - id: oauth2_password
    type: oauth2
    flow: password
    description: >-
      Resource owner password credentials grant. Client authentication is HTTP Basic with
      the base64 of `clientId:clientSecret`; the body carries `username`, `password` and
      `grant_type=password`.
    token_endpoint: 'https://<region-code>-acl.leena.ai/api/v1.0/oauth/token'
    token_endpoint_default_region: https://acl.leena.ai/api/v1.0/oauth/token
    client_authentication: client_secret_basic
    token_type: Bearer
    header: 'Authorization: Bearer <access_token>'
    expires_in: 3600
    refresh_token: true
    scopes_supported:
      - audit-logs:read
    applies_to:
      - openapi/leena-ai-aop-openapi.yml
      - openapi/leena-ai-audit-logs-openapi.yml
    claims:
      - name: botId
        required: true
        note: >-
          The Audit Logs API rejects a token that lacks a `botId` claim with 401
          "Token is missing botId".
      - name: id
        note: The rate limiter keys its per-client window on the JWT `id` claim.
  - id: oauth2_mcp
    type: oauth2
    description: >-
      MCP and A2A both use OAuth 2.0 with the access token sent as a Bearer token in the
      Authorization header. The client ID and secret are generated from Orchestrator
      Settings, and an HTTPS redirect URI must be registered.
    redirect_uri_required: true
    redirect_uri_scheme: https
    applies_to:
      - mcp/leena-ai-mcp.yml
  - id: km_bearer
    type: http
    scheme: bearer
    description: >-
      The Knowledge Management REST connector obtains a temporary bearer token from
      `/api/v1.0/oauth/token` using a clientId, clientSecret, username and password
      supplied by a Leena AI representative.
    token_validity_minutes: 30
    guidance: >-
      Leena AI recommends implementing token refresh logic within your middleware because
      of the 30-minute default validity.
    applies_to:
      - openapi/leena-ai-knowledge-management-openapi.yml
  - id: leena_app_secret
    type: apiKey
    description: >-
      Internal Leena AI services and inbound webhook targets can authenticate with the
      Leena App Secret key, managed within the Leena AI platform. Webhook authentication
      additionally supports No Auth, Basic Authentication and Bearer Token.
    source: https://docs.leena.ai/docs/rest-api
credential_issuance:
  self_service: false
  process: >-
    API credentials (clientId, clientSecret, username, password) are provisioned by a Leena
    AI representative. MCP/A2A OAuth clients are generated by a tenant administrator in
    Orchestrator Settings.
sso:
  supported: true
  note: >-
    Leena AI documents enterprise identity integrations including Okta for platform SSO.
  source: https://docs.leena.ai/docs/okta