Patronus Protect · Authentication Profile

Patronus Protect Authentication

Authentication

Patronus Protect secures its APIs with http and oauth2 across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

AI SafetyPrompt InjectionSecurityLLMAgent-NativeMCPDLPPIIOn-DeviceAI Firewall

Methods: http, oauth2 Schemes: 2 OAuth flows: authorizationCode API key in:

Security Schemes

apiKey http

scheme: bearer · in: header ()

oauth2 oauth2

· flows: authorizationCode

Source

Authentication Profile

generated: '2026-09-20'
method: derived
source: >-
  API-key scheme derived from the provider's first-party SDK client
  (github.com/patronus-protect/patronus-security-cli sdk/python/src/patronus_api_client/client.py).
  OAuth2 scheme from live discovery at control.patronus.studio/.well-known/oauth-authorization-server
  and /.well-known/oauth-protected-resource plus the 401 challenge on control.patronus.studio/api/mcp.
  The authoritative OpenAPI (docs.patronus.studio/openapi.json) is Cloudflare JS-challenged and was
  not fetchable, so the API-key scheme is derived from the SDK rather than the spec securitySchemes.
summary:
  types: [http, oauth2]
  http_bearer: true
  oauth2_flows: [authorizationCode]
schemes:
- name: apiKey
  type: http
  scheme: bearer
  in: header
  parameter_name: Authorization
  format: "Bearer <PATRONUS_API_KEY>"
  applies_to: REST Scan API (control.patronus.studio/api/v1) and API-key MCP access
  description: >-
    Server-to-server access to the Scan API uses a bearer API key in the Authorization header. The
    SDK reads it from the PATRONUS_API_KEY environment variable. A rate-limited anonymous allowance
    exists for public-URL scans without a key; MCP-server audits always require an authenticated key.
  sources: [sdk/python/client.py]
- name: oauth2
  type: oauth2
  applies_to: Remote MCP server (control.patronus.studio/api/mcp)
  description: >-
    The remote MCP server is protected by OAuth 2.1 (authorization code + PKCE, public clients via
    Dynamic Client Registration). Handled by the MCP host, not the API-key SDK clients.
  flows:
  - flow: authorizationCode
    resource: https://control.patronus.studio/api
    authorization_server: https://control.patronus.studio
    authorization_endpoint: https://control.patronus.studio/mcp-authorize
    token_endpoint: https://control.patronus.studio/api/oauth/mcp/token
    registration_endpoint: https://control.patronus.studio/api/oauth/mcp/register
    pkce: S256
    grant_types: [authorization_code]
    token_endpoint_auth_methods: [none]
    scopes: [scan:read, scan:write]
    bearer_methods: [header]
  sources:
  - well-known/patronus-protect-oauth-authorization-server.json
  - well-known/patronus-protect-oauth-protected-resource.json

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/patronus-protect-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.