Plain Authentication

generated: '2026-07-20'
method: searched
source: https://www.plain.com/docs/graphql/authentication.md
docs: https://www.plain.com/docs/graphql/authentication
summary:
  types: [apiKey, oauth2, mutualTLS]
  api_key_in: [header]
  api_key_prefix: plainApiKey_
schemes:
  - name: apiKey
    type: apiKey
    in: header
    header: Authorization
    format: "Bearer plainApiKey_xxx"
    note: >-
      API keys belong to Machine Users and carry fine-grained permissions
      selected at creation. A Machine User can hold multiple keys for rotation.
      Keys are shown once and cannot be retrieved again.
  - name: permissions
    type: rbac
    note: >-
      Calls are authorized against per-key permissions (e.g.
      indexedDocument:create, thread:reply). Insufficient permissions return an
      error naming the permission required.
  - name: oauth2
    type: oauth2
    note: >-
      OAuth is used by the hosted MCP server (mcp.plain.com/mcp); an agent
      authenticates as an existing Plain user and inherits that user's
      permissions.
  - name: mutualTLS
    type: mutualTLS
    docs: https://www.plain.com/docs/mtls
    note: mTLS is supported for webhook delivery and customer-card requests.
webhook_verification:
  request_signing:
    docs: https://www.plain.com/docs/request-signing
    header: Plain-Request-Signature
    algorithm: HMAC-SHA256
    encoding: hex
    note: >-
      Workspace-global HMAC secret (Settings -> Request signing). The signature
      is the HMAC-SHA256 of the raw request body, hex-encoded.
  basic_auth: true
  mtls: true