Netlify Authentication

generated: '2026-08-27'
method: searched
source: openapi/netlify-accesstoken-api-openapi.yml, openapi/netlify-accountmembership-api-openapi.yml,
  openapi/netlify-accounttype-api-openapi.yml, openapi/netlify-asset-api-openapi.yml, openapi/netlify-assetpublicsignature-api-openapi.yml,
  openapi/netlify-auditlog-api-openapi.yml, openapi/netlify-build-api-openapi.yml, openapi/netlify-buildhook-api-openapi.yml,
  openapi/netlify-buildlogmsg-api-openapi.yml, openapi/netlify-deploy-api-openapi.yml, openapi/netlify-deployedbranch-api-openapi.yml,
  openapi/netlify-deploykey-api-openapi.yml ...
summary:
  types:
  - oauth2
  oauth2_flows:
  - implicit
schemes:
- name: netlifyAuth
  type: oauth2
  flows:
  - flow: implicit
    authorizationUrl: https://app.netlify.com/authorize
    scopes: 0
  sources:
  - openapi/netlify-accesstoken-api-openapi.yml
  - openapi/netlify-accountmembership-api-openapi.yml
  - openapi/netlify-accounttype-api-openapi.yml
  - openapi/netlify-asset-api-openapi.yml
  - openapi/netlify-assetpublicsignature-api-openapi.yml
  - openapi/netlify-auditlog-api-openapi.yml
  - openapi/netlify-build-api-openapi.yml
  - openapi/netlify-buildhook-api-openapi.yml
  - openapi/netlify-buildlogmsg-api-openapi.yml
  - openapi/netlify-deploy-api-openapi.yml
  - openapi/netlify-deployedbranch-api-openapi.yml
  - openapi/netlify-deploykey-api-openapi.yml
  - openapi/netlify-devserver-api-openapi.yml
  - openapi/netlify-devserverhook-api-openapi.yml
  - openapi/netlify-dnszone-api-openapi.yml
  - openapi/netlify-environmentvariables-api-openapi.yml
  - openapi/netlify-file-api-openapi.yml
  - openapi/netlify-form-api-openapi.yml
  - openapi/netlify-function-api-openapi.yml
  - openapi/netlify-hook-api-openapi.yml
  - openapi/netlify-hooktype-api-openapi.yml
  - openapi/netlify-member-api-openapi.yml
  - openapi/netlify-metadata-api-openapi.yml
  - openapi/netlify-paymentmethod-api-openapi.yml
  - openapi/netlify-purge-api-openapi.yml
  - openapi/netlify-serviceinstance-api-openapi.yml
  - openapi/netlify-services-api-openapi.yml
  - openapi/netlify-site-api-openapi.yml
  - openapi/netlify-snicertificate-api-openapi.yml
  - openapi/netlify-snippet-api-openapi.yml
  - openapi/netlify-splittest-api-openapi.yml
  - openapi/netlify-submission-api-openapi.yml
  - openapi/netlify-ticket-api-openapi.yml
  - openapi/netlify-user-api-openapi.yml
  - openapi/netlify-x-internal-api-openapi.yml
docs: https://docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api/#authentication
upgraded: '2026-08-27: derived profile enriched from Netlify''s own API guide (fetched as Markdown) and
  from live unauthenticated responses against https://api.netlify.com/api/v1.'
profile:
  primary: OAuth 2.0 Bearer token
  header: 'Authorization: Bearer <token>'
  transport: HTTPS only. All requests must use HTTPS.
  token_types:
  - name: personal access token (PAT)
    issued_at: https://app.netlify.com/user/applications#personal-access-tokens
    prefix: null
    note: Generated by hand in user settings. No prefix distinguishes a PAT from an OAuth token.
  - name: OAuth 2.0 access token
    authorization_endpoint: https://app.netlify.com/authorize
    registration: https://app.netlify.com/applications
    note: Required for public integrations, so an end user can authorize an app without pasting a token.
  declared_flow: implicit
  declared_flow_note: 'The OpenAPI declares flow: implicit. RFC 9700 (OAuth 2.0 Security BCP) recommends
    against the implicit flow; authorization code with PKCE is current guidance. Netlify''s MCP authorization
    server, by contrast, advertises response_types_supported ["code"].'
  scopes: none — see scopes/netlify-scopes.yml
  mtls: false
  api_key_header: false
  basic_auth: false
operational_constraints:
- A Netlify password reset permanently invalidates every PAT and OAuth token created before it.
- Under team SAML SSO, a PAT is denied access to the team by default. Access must be granted when the
  token is generated, while signed in to that team with SSO.
- CLI tokens appear under Authorized applications as "Netlify CLI" and can be revoked there independently
  of PATs.
observed:
  url: https://api.netlify.com/api/v1/sites
  method: GET
  no_credential: true
  http_status: 401
  body: '{"code":401,"message":"Access Denied"}'
  checked: '2026-08-27'
related:
  mcp: The Netlify MCP server uses a separate OAuth 2.0 authorization server with dynamic client registration
    and a read/write scope split. See mcp/netlify-mcp.yml and well-known/netlify-mcp-oauth-authorization-server.json.
  conventions: conventions/netlify-conventions.yml
  scopes: scopes/netlify-scopes.yml