MSCI · Authentication Profile

Msci Authentication

Authentication

MSCI secures its APIs with oauth2 and openIdConnect across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, deviceCode, and clientInitiatedBackchannelAuthentication flow(s).

Financial DataIndexesESGClimateRisk AnalyticsReal-EstatePrivate AssetsInvesting

Methods: oauth2, openIdConnect Schemes: 3 OAuth flows: authorizationCode, deviceCode, clientInitiatedBackchannelAuthentication API key in:

Security Schemes

MSCI Accounts OIDC openIdConnect

MSCI API gateway OAuth (api2.msci.com) oauth2

MSCI Connector MCP OAuth (mcp.msci.com) oauth2

Source

Authentication Profile

generated: '2026-07-22'
method: searched
source: https://accounts.msci.com/.well-known/openid-configuration
docs: https://developer.msci.com
summary:
  types:
    - oauth2
    - openIdConnect
  oauth2_flows:
    - authorizationCode
    - deviceCode
    - clientInitiatedBackchannelAuthentication
  issuer: https://accounts.msci.com/
schemes:
  - name: MSCI Accounts OIDC
    type: openIdConnect
    openIdConnectUrl: https://accounts.msci.com/.well-known/openid-configuration
    issuer: https://accounts.msci.com/
    authorization_endpoint: https://accounts.msci.com/authorize
    token_endpoint: https://accounts.msci.com/oauth/token
    device_authorization_endpoint: https://accounts.msci.com/oauth/device/code
    userinfo_endpoint: https://accounts.msci.com/userinfo
    jwks_uri: https://accounts.msci.com/.well-known/jwks.json
    revocation_endpoint: https://accounts.msci.com/oauth/revoke
    registration_endpoint: https://accounts.msci.com/oidc/register
    code_challenge_methods_supported: [S256, plain]
    token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post, private_key_jwt, none]
    backchannel_authentication_endpoint: https://accounts.msci.com/bc-authorize
    sources:
      - well-known/msci-accounts-openid-configuration.json
  - name: MSCI API gateway OAuth (api2.msci.com)
    type: oauth2
    metadata: https://api2.msci.com/.well-known/oauth-authorization-server
    authorization_endpoint: https://mcp.msci.com/oauth/authorize
    token_endpoint: https://accounts.msci.com/oauth/token
    note: >-
      RFC 8414 authorization-server metadata published on the production API
      gateway; API calls are bearer-token authenticated and return 401
      "Authorization Header Missing" anonymously (verified against
      https://api2.msci.com/esg/data/v3.0/issuers).
    sources:
      - well-known/msci-api2-oauth-authorization-server.json
  - name: MSCI Connector MCP OAuth (mcp.msci.com)
    type: oauth2
    metadata: https://mcp.msci.com/.well-known/oauth-authorization-server
    authorization_endpoint: https://mcp.msci.com/oauth/authorize
    registration_endpoint: https://mcp.msci.com/iams/v1.0/apps/spa
    note: MSCI Connector (MCP) sign-in uses MSCI ONE / Private i credentials with app consent on first use.
    sources:
      - well-known/msci-mcp-oauth-authorization-server.json
notes: >-
  MSCI publishes no public OpenAPI documents, so no securitySchemes could be
  derived from specs; this profile is assembled from the live RFC 8414 / OIDC
  discovery documents and the MSCI Connector user guide. Developer portal API
  detail pages (developer.msci.com/apis/*) require an MSCI client login.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/msci-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.