Machine0 Authentication

generated: '2026-07-20'
method: searched
source: >-
  https://docs.machine0.io/mcp/overview, https://docs.machine0.io/cli/account,
  and the OAuth discovery documents at
  https://app.machine0.io/.well-known/oauth-authorization-server
description: >-
  machine0's control plane authenticates with OAuth 2.0. Interactive clients (the
  CLI `machine0 login`, and MCP clients such as Claude Desktop / Claude Code / the
  claude.ai custom connector) run a browser-based authorization-code flow with
  PKCE; the MCP server advertises itself as an RFC 9728 OAuth protected resource
  with RFC 8414 authorization-server metadata and RFC 7591 dynamic client
  registration. Programmatic/automation access uses a static credential: an API
  key via the x-api-key header (MCP) or the MACHINE0_API_TOKEN environment
  variable (CLI). SSH access to VMs is a separate, key-based layer.
schemes:
  - type: oauth2
    name: machine0 OAuth
    flow: authorization_code
    pkce: S256
    issuer: https://app.machine0.io
    authorization_endpoint: https://app.machine0.io/api/auth/mcp/authorize
    token_endpoint: https://app.machine0.io/api/auth/mcp/token
    userinfo_endpoint: https://app.machine0.io/api/auth/mcp/userinfo
    registration_endpoint: https://app.machine0.io/api/auth/mcp/register
    scopes: [openid, profile, email, offline_access]
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
    id_token_signing_alg: RS256
    used_by: [CLI login, MCP interactive clients]
    discovery:
      protected_resource: well-known/machine0-mcp-oauth-protected-resource.json
      authorization_server: well-known/machine0-oauth-authorization-server.json
  - type: apiKey
    name: x-api-key
    in: header
    used_by: [MCP programmatic clients]
    provisioning: Generated from account settings.
  - type: apiKey
    name: MACHINE0_API_TOKEN
    in: environment
    used_by: [CLI automation / non-interactive]
  - type: ssh
    name: SSH keypair
    detail: >-
      VM shell access uses SSH keys — either a user-registered public key or a
      server-managed keypair (ssh_key_create_managed) required for remote command
      execution (ssh_exec). Distinct from control-plane auth.