Monte Carlo Authentication

generated: '2026-09-16'
method: searched
source: https://docs.getmontecarlo.com/docs/api-authentication
docs: https://docs.getmontecarlo.com/docs/api-authentication
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
schemes:
- name: mcdHeaders
  type: apiKey
  in: header
  parameter: x-mcd-id
  paired_with: x-mcd-token
  apis: [monte-carlo:graphql-api]
  description: >-
    Personal or account-level API key (Key ID + Secret, 56-character base64 strings from 42 random bytes;
    the secret is shown once). Sent as `x-mcd-id` and `x-mcd-token` on every request. Created at
    Settings -> API with a chosen key type and expiration.
  sources:
  - openapi/monte-carlo-graph-ql-api-openapi.yml
  - https://docs.getmontecarlo.com/docs/api-authentication
- name: oauthClientCredentials
  type: oauth2
  flow: clientCredentials
  apis: [monte-carlo:graphql-api]
  token_url: https://api.getmontecarlo.com/oauth2/token
  scopes: ['https://api.getmontecarlo.com/access', 'https://instance.getmontecarlo.com/{instance_id}']
  description: Personal or Service OAuth clients exchange client ID + secret for a short-lived JWT sent as a Bearer token.
  sources:
  - https://docs.getmontecarlo.com/docs/api-authentication#authenticating-with-oauth-client-credentials
- name: ingestionKey
  type: apiKey
  in: header
  parameter: x-mcd-id
  paired_with: x-mcd-token
  apis: [monte-carlo:push-ingest-api]
  description: Dedicated Ingestion-scoped integration key, optionally restricted to warehouse UUIDs; standard API keys are rejected and it cannot call GraphQL.
  sources:
  - https://docs.getmontecarlo.com/docs/push-ingest-api#authentication
- name: mcpOAuth
  type: oauth2
  flow: authorizationCode
  pkce: S256
  dynamic_client_registration: true
  apis: [monte-carlo:mcp-server]
  authorization_server: https://auth.getmontecarlo.com
  authorization_url: https://auth.getmontecarlo.com/oauth2/authorize
  token_url: https://auth.getmontecarlo.com/oauth2/token
  scopes: [offline_access]
  sources:
  - https://docs.getmontecarlo.com/docs/mcp-server
  - https://auth.getmontecarlo.com/.well-known/oauth-authorization-server
- name: mcpServerKey
  type: http
  scheme: bearer
  format: '<KEY_ID>:<KEY_SECRET>'
  apis: [monte-carlo:mcp-server]
  description: MCP Server key type only (also accepted as x-mcd-id / x-mcd-token headers).
  sources:
  - https://docs.getmontecarlo.com/docs/mcp-server#option-3-api-keys-advanced
sso: SSO and SCIM provisioning (Okta, Microsoft Entra ID) for the web app, Scale plan and above.
key_rotation: https://docs.getmontecarlo.com/docs/rotating-keys