Monetizenow Authentication

generated: '2026-08-13'
method: searched
source: https://docs.monetizenow.io/reference/getting-started-with-your-api
docs: https://docs.monetizenow.io/docs/api-keys
base_url: https://api.monetizeplatform.com
description: >-
  MonetizeNow has two distinct authentication surfaces. The documented REST API
  uses a single tenant-generated API key in an x-api-key header, with no scopes
  and no test/live key separation. The undocumented but live MCP server at
  mcp.monetizeplatform.com uses OAuth 2.x bearer tokens with dynamic client
  registration and PKCE S256, discovered from its own RFC 8414 / RFC 9728
  metadata.
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
schemes:
- name: apiKey
  type: apiKey
  in: header
  parameter_name: x-api-key
  applies_to: https://api.monetizeplatform.com (all REST operations)
  description: >-
    The preferred (and documented) authentication method is a tenant-generated
    API key sent in the x-api-key request header. Keys are created in the
    MonetizeNow tenant under Settings -> API Keys ("New Api Key"), named, and
    displayed only once at creation. A single key authenticates against all
    MonetizeNow REST APIs.
  provisioning: MonetizeNow tenant UI (Settings -> API Keys)
  scoped: false
  key_prefix: not published
  rotation_policy: not published
  sources:
  - https://docs.monetizenow.io/reference/getting-started-with-your-api
  - https://docs.monetizenow.io/docs/api-keys
- name: mcpOAuth
  type: oauth2
  applies_to: https://mcp.monetizeplatform.com/mcp
  description: >-
    OAuth 2.x bearer, discovered live. Unauthenticated requests return HTTP 401
    with WWW-Authenticate: Bearer realm="mcp". Dynamic client registration is
    open at /oauth/register; PKCE S256 required; token endpoint auth method
    "none" (public clients).
  flows:
  - flow: authorizationCode
    authorizationUrl: https://mcp.monetizeplatform.com/oauth/authorize
    tokenUrl: https://mcp.monetizeplatform.com/oauth/token
    refreshSupported: true
    scopes: {}
  discovery:
  - {spec: 'RFC 8414', url: 'https://mcp.monetizeplatform.com/.well-known/oauth-authorization-server', status: 200}
  - {spec: 'RFC 9728', url: 'https://mcp.monetizeplatform.com/.well-known/oauth-protected-resource', status: 200}
  scoped: false
  detail: scopes/monetizenow-scopes.yml
  sources:
  - https://mcp.monetizeplatform.com/.well-known/oauth-authorization-server
notes:
- >-
  The REST key is tenant-wide and unscoped: one key grants access to every
  MonetizeNow REST API in the tenant. No read-only key type, no per-resource
  permission, and no key prefix convention are published.
- >-
  No test-vs-live key separation is documented; see sandbox/monetizenow-sandbox.yml.
- >-
  The application console (app.monetizeplatform.com) uses a separate interactive
  login and, per the Information Security Policy, SSO/SAML with MFA for workforce
  access. That is human sign-in, not API authentication.
- >-
  The OAuth authorization server publishes no scope vocabulary
  (scopes_supported: []), so an MCP client cannot request narrowed access.