Manychat Authentication

generated: '2026-08-13'
method: derived
source: openapi/manychat-page-api-openapi.yml, openapi/manychat-profile-api-openapi.yml, openapi/manychat-sending-api-openapi.yml,
  openapi/manychat-subscriber-api-openapi.yml
docs: https://help.manychat.com/hc/en-us/articles/14959510331420-API-Manychat
note: >-
  ManyChat has exactly one credential type and no authorization surface at all. The token is an API key
  generated per connected page in the ManyChat dashboard under Settings > API, sent as
  `Authorization: Bearer <page-id>:<api-key>` — the page id is part of the credential, so the key is
  intrinsically page-scoped and there is no account-wide or cross-page token. Verified against the
  Swagger document ManyChat serves at https://api.manychat.com/swagger/compileJson?type=Page_API
  on 2026-08-13; the linked help article is the provider's own reference but is currently unreadable to
  non-browser clients (help.manychat.com returns 403 behind a Cloudflare challenge).
summary:
  types:
  - http
  api_key_in: []
  oauth2_flows: []
  oauth2: false
  openid_connect: false
  mutual_tls: false
  scopes: false
  key_format: 'Bearer <page-id>:<api-key>'
  key_scope: one connected page
  rotation_documented: false
  auth_failure_status_documented: false
absences:
  - >-
    No OAuth 2.0. There is no authorization endpoint, no token endpoint, no refresh, no scopes and no
    consent screen — a third party cannot be delegated access on a user's behalf through the public API.
    /.well-known/oauth-authorization-server returns 404 on api.manychat.com.
  - No OpenID Connect. /.well-known/openid-configuration returns 404 on api.manychat.com.
  - No mutual TLS, no request signing, no HMAC.
  - >-
    No 401 or 403 response is declared on ANY operation in the published spec despite every operation
    requiring the Bearer token — the behaviour on a bad or revoked key is undocumented.
  - No key rotation, expiry or revocation contract is published.
related_surface:
  - >-
    `verifyBySignedRequest` (POST /fb/subscriber/verifyBySignedRequest) verifies a Meta signed-request
    payload to identify a subscriber. It authenticates the END USER inside a Messenger webview, not the
    API caller, and still requires the page Bearer token itself.
  - >-
    The External Request / Dynamic Block callback surface has NO published authentication in either
    direction — see asyncapi/manychat-dynamic-block-webhooks.yml.
schemes:
- name: Bearer
  type: http
  scheme: bearer
  description: 'API key generated per page in the ManyChat dashboard under Settings > API. Sent
    as `Authorization: Bearer <page-id>:<api-key>`.'
  sources:
  - openapi/manychat-page-api-openapi.yml
  - openapi/manychat-profile-api-openapi.yml
  - openapi/manychat-sending-api-openapi.yml
  - openapi/manychat-subscriber-api-openapi.yml