Linktree · Authentication Profile

Linktree Authentication

Authentication

Linktree secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, clientCredentials, refreshToken, deviceCode, ciba, jwtBearer, and tokenExchange flow(s).

CompanyMediaLink in BioCreator EconomySocial MediaMarketingAnalyticsMCPAgents
Methods: oauth2 Schemes: 1 OAuth flows: authorizationCode, clientCredentials, refreshToken, deviceCode, ciba, jwtBearer, tokenExchange API key in:

Security Schemes

LinktreeMCPOAuth2 oauth2

Source

Authentication Profile

linktree-authentication.yml Raw ↑ 
# Authentication profile derived from Linktree's published OAuth metadata.
generated: '2026-07-19'
method: searched
source: https://linktr.ee/.well-known/oauth-authorization-server
docs: https://mcp.linktr.ee/docs
summary:
  types: [oauth2]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken, deviceCode, ciba, jwtBearer, tokenExchange]
  identity_provider: Descope
  scope_count: 30
  dynamic_client_registration: true
  pkce_required_methods: [S256]
  dpop_supported: true
schemes:
  - name: LinktreeMCPOAuth2
    type: oauth2
    issuer: https://mcp.linktr.ee
    authorization_endpoint: https://ciam.linktr.ee/oauth2/v1/apps/agentic/P32ACVpudk8MNftmpf1LR1pW5k8s/MS3C64tMj5Trl5KunDJVudGIMAeGB/authorize
    token_endpoint: https://ciam.linktr.ee/oauth2/v1/apps/agentic/P32ACVpudk8MNftmpf1LR1pW5k8s/MS3C64tMj5Trl5KunDJVudGIMAeGB/token
    userinfo_endpoint: https://ciam.linktr.ee/oauth2/v1/apps/P32ACVpudk8MNftmpf1LR1pW5k8s/userinfo
    revocation_endpoint: https://ciam.linktr.ee/oauth2/v1/apps/P32ACVpudk8MNftmpf1LR1pW5k8s/revoke
    registration_endpoint: https://ciam.linktr.ee/v1/mgmt/mcp/client/P32ACVpudk8MNftmpf1LR1pW5k8s/MS3C64tMj5Trl5KunDJVudGIMAeGB/register
    jwks_uri: https://ciam.linktr.ee/P32ACVpudk8MNftmpf1LR1pW5k8s/.well-known/jwks.json
    grant_types_supported:
      - "authorization_code"
      - "refresh_token"
      - "client_credentials"
      - "urn:ietf:params:oauth:grant-type:device_code"
      - "urn:openid:params:grant-type:ciba"
      - "urn:ietf:params:oauth:grant-type:jwt-bearer"
      - "urn:ietf:params:oauth:grant-type:token-exchange"
    token_endpoint_auth_methods_supported:
      - none
      - client_secret_basic
      - client_secret_post
    id_token_signing_alg_values_supported: [RS256]
    dpop_signing_alg_values_supported: [RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, EdDSA]
    claims_supported: [iss, aud, iat, exp, sub, name, email, email_verified, phone_number, phone_number_verified, picture, family_name, given_name]
    sources: [well-known/linktree-oauth-authorization-server.json]
protected_resource:
  resource: https://mcp.linktr.ee/mcp
  metadata: https://mcp.linktr.ee/.well-known/oauth-protected-resource
  bearer_methods_supported: [header]
  rfc: RFC 9728 (OAuth 2.0 Protected Resource Metadata)
notes:
  - Linktree publishes no public REST API; OAuth here protects the MCP server, not a REST surface.
  - An unauthenticated call to the MCP endpoint returns 401 with a WWW-Authenticate Bearer challenge carrying resource_metadata.