MEF · Authentication Profile

Mef Authentication

Authentication

MEF secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials flow(s).

TelecommunicationsUnited StatesStandardsLSONetwork APIsCAMARAOpen GatewayBSSOSSCarrier EthernetSD-WANSASENaaSService OrchestrationInterconnectionCertification

Methods: oauth2 Schemes: 1 OAuth flows: clientCredentials API key in:

Security Schemes

oauth2MEFLSOAPI oauth2

· flows: clientCredentials

Source

Authentication Profile

generated: '2026-07-25'
method: searched
source: https://github.com/MEF-GIT/MEF-LSO-Sonata-SDK/tree/kylie/generated/security
docs: https://lso.mplify.net/api-catalog
summary:
  types: [oauth2]
  api_key_in: []
  oauth2_flows: [clientCredentials]
  model: two-legged machine-to-machine OAuth 2.0 between a Buyer system and a Seller system
posture: >-
  Mplify (formerly MEF) is a standards body, not an API operator. The 94 canonical LSO API
  documents in productApi/ and serviceApi/ declare NO securitySchemes at all — they are
  contracts that each implementing Seller secures on its own authorization server. The
  security model is published separately, as a second generated variant of every document.
schemes:
  - name: oauth2MEFLSOAPI
    type: oauth2
    description: Default m2m client code
    flows:
      - flow: clientCredentials
        tokenUrl: http://mef.net/example/token
        refreshUrl: http://mef.net/example/refresh
        scopes:
          default: default scope
    applied: >-
      Document-level `security: [{oauth2MEFLSOAPI: [default]}]` plus an operation-level
      requirement carrying a scope named after the operationId (218 distinct scopes).
    sources:
      - https://raw.githubusercontent.com/MEF-GIT/MEF-LSO-Sonata-SDK/kylie/generated/security/order/productOrderManagement.api.yaml
      - https://github.com/MEF-GIT/MEF-LSO-Cantata-SDK/tree/kylie/generated/security
      - https://github.com/MEF-GIT/MEF-LSO-Interlude-SDK/tree/kylie/generated/security
      - https://github.com/MEF-GIT/MEF-LSO-Legato-SDK/tree/kylie/generated/security
      - https://github.com/MEF-GIT/MEF-LSO-Allegro-SDK/tree/kylie/generated/security
    documents: 88
    note: >-
      The tokenUrl and refreshUrl shipped in the published documents are deliberate placeholders
      on the mef.net example host. The implementing Seller substitutes its own authorization
      server; Mplify does not operate one.
mcp_client_auth:
  source: https://github.com/MEF-GIT/MEF-LSO-Sonata-SDK/tree/kylie/generated/mcp/mplify-mcp-runner
  modes: [none, basic, oauth-refresh]
  default_in_shipped_env_files: basic (MCP_AUTH_MODE=basic, credentials placeholder user:password)
  oauth_refresh: >-
    OAuth 2.0 refresh-token grant with automatic refresh and one retry on 401
    (MCP_OAUTH_TOKEN_URL / CLIENT_ID / CLIENT_SECRET / REFRESH_TOKEN / SCOPE / AUDIENCE).
  note: >-
    This is how Mplify's own MCP runner authenticates to a Seller's live implementation — the
    only place Mplify publishes concrete, runnable auth configuration.
not_documented:
  - api keys
  - mutual TLS
  - OpenID Connect discovery (https://lso.mplify.net/.well-known/openid-configuration returns 404)
  - CIBA / subscriber-consent flows (structurally absent — LSO is B2B, not subscriber-facing)
related:
  scopes: scopes/mef-scopes.yml
  conventions: conventions/mef-conventions.yml
  conformance: conformance/mef-conformance.yml

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/mef-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.