NinjaOne · Authentication Profile

Ninjaone Authentication

Authentication

NinjaOne secures its APIs with oauth2 and apiKey across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the clientCredentials, authorizationCode, and refreshToken flow(s).

CompanyDeveloper ToolsIT ManagementRMMEndpoint ManagementMSPIT OperationsMonitoringAutomationTicketing
Methods: oauth2, apiKey Schemes: 2 OAuth flows: clientCredentials, authorizationCode, refreshToken API key in: cookie

Security Schemes

oauth2 http
scheme: bearer
sessionKey apiKey
· in: cookie (sessionKey)

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-20'
method: searched
source: openapi/ninjaone-openapi-original.yml
docs: https://www.ninjaone.com/docs/application-programming-interface-api/oauth-token-configuration/
summary:
  types:
  - oauth2
  - apiKey
  api_key_in:
  - cookie
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  - refreshToken
notes: >-
  The NinjaOne Public API is secured with OAuth 2.0. Machine-to-machine
  integrations use the client-credentials grant; interactive apps use the
  authorization-code grant (PKCE, S256) with refresh tokens. Tokens are Bearer
  tokens sent in the Authorization header and expire in 3600 seconds. The
  OpenAPI models the bearer requirement as an http/bearer scheme named "oauth2";
  the OAuth 2.0 endpoints below are published in the authorization-server
  metadata at https://app.ninjarmm.com/.well-known/oauth-authorization-server.
oauth2:
  authorization_endpoint: https://app.ninjarmm.com/ws/oauth/authorize
  token_endpoint: https://app.ninjarmm.com/ws/oauth/token
  revocation_endpoint: https://app.ninjarmm.com/ws/oauth/revoke
  grant_types_supported:
  - authorization_code
  - client_credentials
  - refresh_token
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  code_challenge_methods_supported:
  - S256
  scopes:
  - monitoring
  - management
  - control
schemes:
- name: oauth2
  type: http
  scheme: bearer
  bearerFormat: bearer
  sources:
  - openapi/ninjaone-openapi-original.yml
- name: sessionKey
  type: apiKey
  in: cookie
  parameter: sessionKey
  sources:
  - openapi/ninjaone-openapi-original.yml