Mavenlink Authentication

generated: '2026-08-25'
method: searched
source: https://developer.kantata.com/ (Authentication section) + https://api.mavenlink.com/.well-known/openid-configuration
docs: https://developer.kantata.com/
notes: >-
  Derived from the Swagger 2.0 securityDefinitions in openapi/mavenlink-openapi.yml, then upgraded from the
  Kantata OX API documentation Authentication section and from the OpenID Connect / OAuth 2.0 discovery documents
  that api.mavenlink.com and app.mavenlink.com serve anonymously (both probed 2026-08-25, HTTP 200).
summary:
  types:
  - apiKey
  - oauth2
  - openIdConnect
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - refreshToken
  primary: OAuth 2.0 authorization-code bearer token
  anonymous_access: false
  registration_required: true
  registration_note: >-
    Applications must be registered by a Kantata OX account administrator at
    https://app.mavenlink.com/oauth/applications, and a paid Kantata OX account is required to register one.
    There is no self-serve developer sandbox.
schemes:
- name: BearerToken
  type: apiKey
  in: header
  parameter: Bearer
  description: >-
    Swagger 2.0 models the bearer token as an apiKey header named "Bearer". In practice the header is
    `Authorization: Bearer <token>` as documented in the API reference; the securityDefinition name is an
    artifact of Swagger 2.0 having no native bearer type.
  sources:
  - openapi/mavenlink-openapi.yml
  - https://developer.kantata.com/
- name: OauthSecurity
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.mavenlink.com/oauth/authorize
    tokenUrl: https://app.mavenlink.com/oauth/token
    scopes: 0
    note: >-
      The spec declares an empty scopes map. The real scope list is published anonymously in the discovery
      documents - see scopes/mavenlink-scopes.yml.
  sources:
  - openapi/mavenlink-openapi.yml
- name: KantataOpenIDConnect
  type: openIdConnect
  openIdConnectUrl: https://api.mavenlink.com/.well-known/openid-configuration
  issuer: https://app.mavenlink.com
  authorization_endpoint: https://api.mavenlink.com/oauth/authorize
  token_endpoint: https://api.mavenlink.com/oauth/token
  revocation_endpoint: https://api.mavenlink.com/oauth/revoke
  introspection_endpoint: https://api.mavenlink.com/oauth/introspect
  userinfo_endpoint: https://api.mavenlink.com/openid/userinfo
  jwks_uri: https://api.mavenlink.com/openid/discovery/keys
  grant_types_supported:
  - authorization_code
  - client_credentials
  - refresh_token
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  id_token_signing_alg_values_supported:
  - RS256
  code_challenge_methods_supported:
  - plain
  - S256
  claims_supported:
  - iss
  - sub
  - aud
  - exp
  - iat
  - email
  - name
  - given_name
  - family_name
  - preferred_username
  - account_id
  - account_name
  sources:
  - well-known/mavenlink-api-openid-configuration.json
  - well-known/mavenlink-app-openid-configuration.json
token_handling:
  expiry: >-
    The API reference states that Kantata OX OAuth access tokens do not expire and must be protected like
    passwords. Revoking the application's access invalidates the token.
  revocation: https://api.mavenlink.com/oauth/revoke
  refresh: refresh_token grant is advertised in the OIDC discovery document
  transport: HTTPS only; the API reference requires all requests be made over SSL
mcp_authorization:
  resource: https://api.mavenlink.com/mcp
  protected_resource_metadata: https://api.mavenlink.com/.well-known/oauth-protected-resource
  authorization_server: https://api.mavenlink.com
  authorization_server_metadata: https://api.mavenlink.com/.well-known/oauth-authorization-server
  bearer_methods_supported:
  - header
  scopes_supported:
  - mcp
  code_challenge_methods_supported:
  - S256
  probe:
    url: https://api.mavenlink.com/mcp
    method: POST tools/list
    http_status: 401
    www_authenticate: >-
      Bearer realm="Doorkeeper", error="invalid_token",
      resource_metadata="https://api.mavenlink.com/.well-known/oauth-protected-resource"
    checked: '2026-08-25'
gaps:
- >-
  The published Swagger 2.0 contract defines two securityDefinitions but applies neither: there is no global
  `security` block and none of the 419 operations carries an operation-level `security` array. A generated client
  reading only the spec would not send an Authorization header, even though every endpoint requires one.
- >-
  The oauth2 securityDefinition declares an empty `scopes` map, so the scope names published in the discovery
  documents (api_only, openid, email, profile, mcp, offline_access) are invisible to spec-driven tooling.