Limitless · Authentication Profile

Limitless Ai Authentication

Authentication

Limitless secures its APIs with apiKey, oauth2, and openIdConnect across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

Artificial IntelligenceWearablePendantMeeting NotesLifelogsPersonal AIMCPOpenAPI

Methods: apiKey, oauth2, openIdConnect Schemes: 3 OAuth flows: authorizationCode API key in: header

Security Schemes

X-API-Key apiKey

· in: header ()

LimitlessOAuth oauth2

LimitlessOIDC openIdConnect

Source

Authentication Profile

generated: '2026-07-19'
method: searched
source: openapi/limitless-developer-openapi-original.yml
docs: https://www.limitless.ai/developers
summary:
  types:
  - apiKey
  - oauth2
  - openIdConnect
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  note: >-
    The published Swagger 2.0 document declares NO securityDefinitions, so no auth
    profile could be derived mechanically from the spec. This profile was captured
    from the developer documentation and from the live /.well-known/ discovery
    documents on api.limitless.ai.
schemes:
- name: X-API-Key
  type: apiKey
  in: header
  parameter_name: X-API-Key
  description: >-
    Primary authentication for the REST API. Every request must carry the API key in
    the X-API-Key header. Keys are created in Developer settings in the Limitless
    Desktop or Web app (https://app.limitless.ai).
  source: https://www.limitless.ai/developers
  spec_declared: false
- name: LimitlessOAuth
  type: oauth2
  flow: authorizationCode
  authorizationUrl: https://api.limitless.ai/api/auth/authorize
  tokenUrl: https://api.limitless.ai/api/auth/token
  revocationUrl: https://api.limitless.ai/api/auth/revoke
  registrationUrl: https://api.limitless.ai/api/auth/register
  pkce: S256
  token_endpoint_auth_methods:
  - client_secret_post
  - none
  grant_types:
  - authorization_code
  - refresh_token
  scopes:
  - openid
  - profile
  - email
  - lifelogs:read
  description: >-
    OAuth 2.0 authorization server fronting the hosted MCP server at
    https://api.limitless.ai/mcp. Supports dynamic client registration (RFC 7591) and
    advertises itself as an MCP OAuth authorization server (MCP protocol 2025-06-18).
  source: well-known/limitless-oauth-authorization-server.json
- name: LimitlessOIDC
  type: openIdConnect
  openIdConnectUrl: https://api.limitless.ai/.well-known/openid-configuration
  issuer: https://api.limitless.ai
  userinfo_endpoint: https://api.limitless.ai/api/auth/session
  end_session_endpoint: https://api.limitless.ai/api/auth/signout
  id_token_signing_alg_values_supported:
  - HS256
  claims_supported:
  - sub
  - name
  - email
  - email_verified
  - preferred_username
  - updated_at
  source: well-known/limitless-openid-configuration.json
key_management:
  create: https://app.limitless.ai
  path: Developer settings -> Create API Key
  rotation_policy: not published
related:
  scopes: scopes/limitless-scopes.yml
  conventions: conventions/limitless-conventions.yml

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/limitless-ai-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.