Notice Authentication

generated: '2026-08-26'
method: probed
source: https://api.notice.co/.well-known/oauth-protected-resource
also_source:
  - https://api.stytch.notice.co/.well-known/oauth-authorization-server
  - https://api.stytch.notice.co/.well-known/openid-configuration
  - https://learn.notice.co/en/articles/8422141-how-does-the-notice-api-work
summary: >-
  Notice publishes no OpenAPI a machine can read (api.notice.co/v1/openapi.json exists but answers
  401), so this profile is built from the two auth-discovery documents Notice actually serves plus
  the observed challenge behaviour of the API and MCP endpoints. Two distinct surfaces:
  a REST v1 API sold as an enterprise subscription, whose credential scheme is not documented
  publicly, and an OAuth 2.1-style MCP endpoint whose entire handshake is discoverable anonymously.
schemes:
  - id: mcp_oauth2
    type: oauth2
    applies_to: https://api.notice.co/mcp
    flow: authorizationCode
    pkce: S256
    issuer: https://api.stytch.notice.co
    authorization_endpoint: https://notice.co/oauth/authorize
    token_endpoint: https://api.stytch.notice.co/v1/oauth2/token
    userinfo_endpoint: https://api.stytch.notice.co/v1/oauth2/userinfo
    registration_endpoint: https://api.stytch.notice.co/v1/oauth2/register
    jwks_uri: https://api.stytch.notice.co/.well-known/jwks.json
    id_token_signing_alg_values_supported:
      - RS256
    token_endpoint_auth_methods_supported:
      - client_secret_basic
      - client_secret_post
      - none
    grant_types_supported:
      - authorization_code
      - refresh_token
      - 'urn:ietf:params:oauth:grant-type:jwt-bearer'
    identity_provider: Stytch (api.stytch.notice.co, a Notice-controlled subdomain)
    challenge: 'WWW-Authenticate: Bearer resource_metadata="https://api.notice.co/.well-known/oauth-protected-resource"'
    method: probed
  - id: rest_v1
    type: unknown
    applies_to: https://api.notice.co/v1
    documented: false
    evidence:
      - probe: GET https://api.notice.co/v1/openapi.json
        http_status: 401
        body: '{"error":"Not authorized"}'
      - probe: GET https://api.notice.co/v1/
        http_status: 401
    note: >-
      The help centre states the Notice API is RESTful and sold as an enterprise subscription, but
      names no credential type, header, or key prefix on any public page. No API-key scheme is
      asserted here because none is published - the honest reading is that the auth model is
      documented only to subscribers.
    method: probed
  - id: session_cookie
    type: cookie
    applies_to: https://api.notice.co
    name: _notice_session
    attributes: 'secure; httponly; samesite=lax'
    note: First-party browser session for notice.co; not an integration credential.
    method: probed
session_headers_observed:
  - 'access-control-expose-headers: X-Stytch-Session-JWT'
docs: null
docs_note: >-
  No public authentication reference page exists. notice.co returns HTTP 403 (Cloudflare bot
  block) to non-browser clients, and the help centre article on the API does not describe the
  credential scheme.