Onecli · Authentication Profile

Onecli Authentication

Authentication

Onecli secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanySecurityIdentityAI AgentsSecrets ManagementCredentialsGatewayAuthenticationDeveloper ToolsMCPVault
Methods: http Schemes: 1 OAuth flows: API key in:

Security Schemes

bearerAuth http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-20'
method: searched
source: openapi/onecli-openapi-original.yml
docs: https://onecli.sh/docs/api-reference
summary:
  types:
  - http
  http_schemes:
  - bearer
  api_key_prefixes:
  - oc_          # project-scoped key
  - oc_org_      # organization-scoped key (requires X-Project-Id for project endpoints)
  - oc_partner_  # partner-scoped key (reseller / agency provisioning)
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  description: >-
    API key obtained from the OneCLI dashboard or `GET /v1/user/api-key`, sent as
    `Authorization: Bearer <key>`. Cookie-based dashboard sessions are also accepted.
  sources:
  - openapi/onecli-openapi-original.yml
notes:
- "All endpoints require authentication."
- "Project keys (oc_) operate on a single project."
- "Organization keys (oc_org_) can operate across projects; project-scoped endpoints require an X-Project-Id: proj_... header (a 401 is returned without it)."
- "Organization endpoints (/org/...) need no project header and require the admin or owner role, except GET /org/rules/permissions/{provider} which any member may read."
- "Partner keys (oc_partner_) provision and manage organizations on behalf of customers."
- "OAuth is used by the gateway to connect downstream apps (Google, GitHub, Slack, ...), not to authenticate to the OneCLI management API itself."

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/onecli-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.