MSCI · Authentication Profile

Msci Authentication

Authentication

MSCI secures its APIs with oauth2 and openIdConnect across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, deviceCode, and clientInitiatedBackchannelAuthentication flow(s).

Financial DataIndexesESGClimateRisk AnalyticsReal EstatePrivate AssetsInvesting

Methods: oauth2, openIdConnect Schemes: 3 OAuth flows: authorizationCode, deviceCode, clientInitiatedBackchannelAuthentication API key in:

Security Schemes

MSCI Accounts OIDC openIdConnect

MSCI API gateway OAuth (api2.msci.com) oauth2

MSCI Connector MCP OAuth (mcp.msci.com) oauth2

Source

Authentication Profile

generated: '2026-07-22'
method: searched
source: https://accounts.msci.com/.well-known/openid-configuration
docs: https://developer.msci.com
summary:
  types:
    - oauth2
    - openIdConnect
  oauth2_flows:
    - authorizationCode
    - deviceCode
    - clientInitiatedBackchannelAuthentication
  issuer: https://accounts.msci.com/
schemes:
  - name: MSCI Accounts OIDC
    type: openIdConnect
    openIdConnectUrl: https://accounts.msci.com/.well-known/openid-configuration
    issuer: https://accounts.msci.com/
    authorization_endpoint: https://accounts.msci.com/authorize
    token_endpoint: https://accounts.msci.com/oauth/token
    device_authorization_endpoint: https://accounts.msci.com/oauth/device/code
    userinfo_endpoint: https://accounts.msci.com/userinfo
    jwks_uri: https://accounts.msci.com/.well-known/jwks.json
    revocation_endpoint: https://accounts.msci.com/oauth/revoke
    registration_endpoint: https://accounts.msci.com/oidc/register
    code_challenge_methods_supported: [S256, plain]
    token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post, private_key_jwt, none]
    backchannel_authentication_endpoint: https://accounts.msci.com/bc-authorize
    sources:
      - well-known/msci-accounts-openid-configuration.json
  - name: MSCI API gateway OAuth (api2.msci.com)
    type: oauth2
    metadata: https://api2.msci.com/.well-known/oauth-authorization-server
    authorization_endpoint: https://mcp.msci.com/oauth/authorize
    token_endpoint: https://accounts.msci.com/oauth/token
    note: >-
      RFC 8414 authorization-server metadata published on the production API
      gateway; API calls are bearer-token authenticated and return 401
      "Authorization Header Missing" anonymously (verified against
      https://api2.msci.com/esg/data/v3.0/issuers).
    sources:
      - well-known/msci-api2-oauth-authorization-server.json
  - name: MSCI Connector MCP OAuth (mcp.msci.com)
    type: oauth2
    metadata: https://mcp.msci.com/.well-known/oauth-authorization-server
    authorization_endpoint: https://mcp.msci.com/oauth/authorize
    registration_endpoint: https://mcp.msci.com/iams/v1.0/apps/spa
    note: MSCI Connector (MCP) sign-in uses MSCI ONE / Private i credentials with app consent on first use.
    sources:
      - well-known/msci-mcp-oauth-authorization-server.json
notes: >-
  MSCI publishes no public OpenAPI documents, so no securitySchemes could be
  derived from specs; this profile is assembled from the live RFC 8414 / OIDC
  discovery documents and the MSCI Connector user guide. Developer portal API
  detail pages (developer.msci.com/apis/*) require an MSCI client login.