Pixeltable Authentication

generated: '2026-08-17'
method: searched
source: 'https://www.pixeltable.com/.well-known/agent.json, https://pixeltable.com/developers/llms.txt,
  https://pixeltable.com/security, plus live probes'
note: '0-working/derive-authentication.py produced no profile for this provider (0 auth profiles) because
  there is no OpenAPI in the repo to read securitySchemes from — Pixeltable publishes none. This artifact is
  therefore SEARCHED from the provider''s own capability manifest and developer documentation, and each claim
  was checked against a live probe where a probe was possible. Pixeltable has FOUR distinct auth postures
  across its surfaces, which is the important finding: two agent surfaces are fully anonymous while the cloud
  control plane is session-gated.'
summary:
  types:
  - none
  - apiKey
  - session
  api_key_in:
  - header
  api_key_header: X-api-key
  oauth2_flows: []
  oidc: false
  mutual_tls: false
  anonymous_surfaces: 2
  gated_surfaces: 1
schemes:
- name: open_source_library
  surface: pixeltable Python library
  type: none
  required: false
  published: 'pip install pixeltable — no auth required'
  source: https://www.pixeltable.com/.well-known/agent.json
  note: 'The open-source library needs no credential of any kind. AI provider keys (OpenAI, Anthropic, etc.)
    are the user''s own and are held in ~/.pixeltable/config.toml — they authenticate to third parties, not to
    Pixeltable.'
- name: webmcp_anonymous
  surface: https://pixeltable.com/mcp
  api: pixeltable-webmcp
  type: none
  required: false
  verified: probed
  note: 'Confirmed anonymous. An unauthenticated JSON-RPC tools/list returned HTTP 200 with the full tool set
    on 2026-08-17. No OAuth challenge was issued and neither
    /.well-known/oauth-authorization-server nor /.well-known/oauth-protected-resource is served (both 404),
    which is consistent with a read-only server that requires no authorization.'
- name: ask_anonymous
  surface: https://pixeltable.com/ask
  api: pixeltable-ask
  type: none
  required: false
  verified: probed
  note: Confirmed anonymous. An unauthenticated POST with a `query` body returned HTTP 200 and grounded
    results. Protected by a per-IP rate limit rather than a credential.
- name: cloud_api_key
  surface: Pixeltable Cloud API
  api: pixeltable-cloud-control-plane
  type: apiKey
  in: header
  parameter_name: X-api-key
  required: true
  status_claimed: available
  published: 'cloud_api: {type: api_key, header: X-api-key, status: available}'
  source: https://www.pixeltable.com/.well-known/agent.json
  docs: https://pixeltable.com/developers/llms.txt
  verified: probed
  note: 'CLAIM NOT REPRODUCIBLE ANONYMOUSLY. The provider marks this scheme "available", but a request to
    https://pixeltable.com/api/v1 carrying an X-api-key header returned HTTP 401 with
    {"message":"Authentication required","reason":"no_session_cookie_provided"} — the endpoint asked for a
    session cookie, not an API key. Either the key-authenticated routes live elsewhere (undocumented) or the
    documented header does not yet gate this path. Not resolvable without a real key; recorded honestly.'
- name: workos_authkit_session
  surface: Pixeltable Cloud dashboard and pxt CLI
  api: pixeltable-cloud-control-plane
  type: session
  provider: WorkOS AuthKit
  required: true
  signup_url: https://pixeltable.com/signup
  login_url: https://pixeltable.com/login
  sso: 'Single Sign-On supported where applicable; SAML SSO is a Pro "contact us" / Enterprise feature per the
    pricing page.'
  verified: probed
  note: 'Confirmed. https://pixeltable.com/signup and /login both 302 to signin.pixeltable.com with a WorkOS
    client_id (client_01JJMGYGHGE0KMSZWF0WZGHMC0) and a redirect_uri of
    https://pixeltable.com/api/auth/callback. The security page states Pixeltable "leverage[s]
    industry-standard authentication practices through WorkOS AuthKit". Bearer tokens issued by WorkOS
    authenticate the control plane per the developer llms.txt.'
planned:
- name: public_rest_oauth
  type: oauth2
  status: planned
  published: 'public_rest_api: {type: oauth_scoped, status: planned}'
  source: https://www.pixeltable.com/.well-known/agent.json
  note: 'A public REST API with OpenAPI and scoped OAuth is stated as in active development. No authorization
    server metadata is published yet (/.well-known/oauth-authorization-server 404s), so there are no scopes to
    capture — scopes/ is deliberately absent for this provider.'
x-evidence:
- url: https://www.pixeltable.com/.well-known/agent.json
  http_status: 200
  fetched: '2026-08-17'
- url: https://www.pixeltable.com/mcp
  method: POST
  http_status: 200
  fetched: '2026-08-17'
  note: anonymous tools/list succeeded
- url: https://www.pixeltable.com/api/v1
  method: GET
  http_status: 401
  fetched: '2026-08-17'
  note: 'with X-api-key header; body reason no_session_cookie_provided'
- url: https://pixeltable.com/signup
  http_status: 200
  fetched: '2026-08-17'
  note: redirects to signin.pixeltable.com (WorkOS AuthKit)
- url: https://www.pixeltable.com/.well-known/oauth-authorization-server
  http_status: 404
  fetched: '2026-08-17'