Mindtickle Authentication

generated: '2026-08-14'
method: probed
source: https://app.mindtickle.com/.well-known/oauth-authorization-server
docs: https://www.mindtickle.com/call-ai-public-api-mindtickle/
name: Mindtickle authentication profile
description: >-
  Mindtickle runs two distinct authentication models. The core REST API on
  api.mindtickle.com uses a JWT bearer token minted from an API Key, Secret Key
  and Client ID issued in the admin console (Settings > API Access), with a
  one-hour token lifetime. The application host app.mindtickle.com publishes a
  full OAuth 2.0 authorization server anonymously at the RFC 8414 well-known
  path, including dynamic client registration, PKCE, pushed authorization
  requests and device authorization - this is the surface the Call AI public
  GraphQL API and the platform's AI/agent scopes authenticate against.

summary:
  types: [http, oauth2]
  http_schemes: [bearer]
  bearer_formats: [JWT]
  oauth2_flows: [authorizationCode, clientCredentials, refreshToken, deviceCode]
  api_key_in: []
  discovery: [RFC 8414, RFC 9728]

schemes:
- name: platformJwtBearer
  type: http
  scheme: bearer
  bearerFormat: JWT
  applies_to: https://api.mindtickle.com
  description: >-
    JWT bearer token for the Mindtickle REST API. Credentials (API Key, Secret
    Key, Client ID) are generated by an admin under Settings > API Access in the
    Mindtickle admin console; the JWT is signed by the caller and presented in
    the Authorization header.
  token_lifetime_seconds: 3600
  errors:
  - status: 401
    meaning: Missing or malformed JWT, or incorrect Secret Key
  - status: 403
    meaning: Expired token (JWT validity is capped at one hour)
  sources:
  - https://www.mindtickle.com/platform/integrations/
  - rate-limits/mindtickle-rate-limits.yml

- name: mindtickleOAuth2
  type: oauth2
  applies_to: https://app.mindtickle.com
  description: >-
    OAuth 2.0 authorization server published by the Mindtickle application host.
    Discovered anonymously; the metadata document is archived verbatim at
    well-known/mindtickle-oauth-authorization-server.json.
  issuer: https://app.mindtickle.com
  endpoints:
    authorization: https://app.mindtickle.com/api/users/v1/oauth/authorize
    token: https://app.mindtickle.com/api/users/v1/oauth/token
    registration: https://app.mindtickle.com/api/users/v1/oauth/register
    revocation: https://app.mindtickle.com/api/users/v1/oauth/revoke
    introspection: https://app.mindtickle.com/api/users/v1/oauth/introspect
    pushed_authorization_request: https://app.mindtickle.com/api/users/v1/oauth/par
    device_authorization: https://app.mindtickle.com/api/users/v1/oauth/device/code
    jwks_uri: https://app.mindtickle.com/.well-known/jwks.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.mindtickle.com/api/users/v1/oauth/authorize
    tokenUrl: https://app.mindtickle.com/api/users/v1/oauth/token
  - flow: clientCredentials
    tokenUrl: https://app.mindtickle.com/api/users/v1/oauth/token
  - flow: refreshToken
    tokenUrl: https://app.mindtickle.com/api/users/v1/oauth/token
  - flow: deviceCode
    deviceAuthorizationUrl: https://app.mindtickle.com/api/users/v1/oauth/device/code
    tokenUrl: https://app.mindtickle.com/api/users/v1/oauth/token
  response_types_supported: [code]
  code_challenge_methods_supported: [S256]
  token_endpoint_auth_methods_supported:
  - client_secret_post
  - client_secret_basic
  - private_key_jwt
  bearer_methods_supported: [header]
  scope_count: 7
  scopes_reference: scopes/mindtickle-scopes.yml
  sources:
  - well-known/mindtickle-oauth-authorization-server.json
  - well-known/mindtickle-oauth-protected-resource.json

- name: callAiOAuth2Bearer
  type: http
  scheme: bearer
  applies_to: https://api-gateway.callai.www.mindtickle.com/public/graphapi
  description: >-
    The Call AI public GraphQL API requires an OAuth 2.0 access token passed in
    the Authorization header of every GraphQL request. Mindtickle's public docs
    describe the token as a prerequisite and point at an internal "Generate
    OAuth Access Token" article in the customer help centre, which is behind a
    tenant login.
  sources:
  - https://www.mindtickle.com/call-ai-public-api-mindtickle/

sso:
  description: >-
    Platform (end-user) single sign-on, distinct from API authentication.
  protocols: [SAML 2.0, OpenID Connect, JWT]
  provisioning: SCIM
  source: https://www.mindtickle.com/platform/integrations/

notes:
- >-
  No /.well-known/openid-configuration is published on any Mindtickle host; the
  OAuth 2.0 authorization-server metadata (RFC 8414) is the only discovery
  document, alongside RFC 9728 protected-resource metadata.
- >-
  Dynamic client registration (RFC 7591) is advertised at
  /api/users/v1/oauth/register. It was NOT exercised - registering a client is a
  write, and this pipeline only reads.
- >-
  The step-by-step credential and token-generation guides live in
  help.mindtickle.com, which 302s to an admin-console login, so the operational
  auth documentation is customer-only.