Machine0 · Authentication Profile

Machine0 Authentication

Authentication

machine0's control plane authenticates with OAuth 2.0. Interactive clients (the CLI `machine0 login`, and MCP clients such as Claude Desktop / Claude Code / the claude.ai custom connector) run a browser-based authorization-code flow with PKCE; the MCP server advertises itself as an RFC 9728 OAuth protected resource with RFC 8414 authorization-server metadata and RFC 7591 dynamic client registration. Programmatic/automation access uses a static credential: an API key via the x-api-key header (MCP) or the MACHINE0_API_TOKEN environment variable (CLI). SSH access to VMs is a separate, key-based layer.

Machine0 declares 4 security scheme(s) across its OpenAPI definitions.

CompanyCloudInfrastructureVirtual MachinesAI AgentsDeveloper ToolsCLIMCP

Methods: Schemes: 4 OAuth flows: API key in:

Security Schemes

machine0 OAuth oauth2

x-api-key apiKey

· in: header ()

MACHINE0_API_TOKEN apiKey

· in: environment ()

SSH keypair ssh

Source

Authentication Profile

generated: '2026-07-20'
method: searched
source: >-
  https://docs.machine0.io/mcp/overview, https://docs.machine0.io/cli/account,
  and the OAuth discovery documents at
  https://app.machine0.io/.well-known/oauth-authorization-server
description: >-
  machine0's control plane authenticates with OAuth 2.0. Interactive clients (the
  CLI `machine0 login`, and MCP clients such as Claude Desktop / Claude Code / the
  claude.ai custom connector) run a browser-based authorization-code flow with
  PKCE; the MCP server advertises itself as an RFC 9728 OAuth protected resource
  with RFC 8414 authorization-server metadata and RFC 7591 dynamic client
  registration. Programmatic/automation access uses a static credential: an API
  key via the x-api-key header (MCP) or the MACHINE0_API_TOKEN environment
  variable (CLI). SSH access to VMs is a separate, key-based layer.
schemes:
  - type: oauth2
    name: machine0 OAuth
    flow: authorization_code
    pkce: S256
    issuer: https://app.machine0.io
    authorization_endpoint: https://app.machine0.io/api/auth/mcp/authorize
    token_endpoint: https://app.machine0.io/api/auth/mcp/token
    userinfo_endpoint: https://app.machine0.io/api/auth/mcp/userinfo
    registration_endpoint: https://app.machine0.io/api/auth/mcp/register
    scopes: [openid, profile, email, offline_access]
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
    id_token_signing_alg: RS256
    used_by: [CLI login, MCP interactive clients]
    discovery:
      protected_resource: well-known/machine0-mcp-oauth-protected-resource.json
      authorization_server: well-known/machine0-oauth-authorization-server.json
  - type: apiKey
    name: x-api-key
    in: header
    used_by: [MCP programmatic clients]
    provisioning: Generated from account settings.
  - type: apiKey
    name: MACHINE0_API_TOKEN
    in: environment
    used_by: [CLI automation / non-interactive]
  - type: ssh
    name: SSH keypair
    detail: >-
      VM shell access uses SSH keys — either a user-registered public key or a
      server-managed keypair (ssh_key_create_managed) required for remote command
      execution (ssh_exec). Distinct from control-plane auth.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/machine0-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.