Rillet Authentication

generated: '2026-07-21'
method: searched
source: openapi/rillet-accounting-api-openapi.json
docs: https://docs.api.rillet.com/docs/getting-started
summary:
  types:
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  description: >-
    API keys are passed as a Bearer token in the Authorization header
    (Authorization: Bearer <api_key>). Keys are managed on the Organization
    Settings page. This is the primary auth for direct API access.
  sources:
  - openapi/rillet-accounting-api-openapi.json
- name: oauth2
  type: oauth2
  description: >-
    OAuth 2.0 authorization-code flow (PKCE S256) used for the remote MCP
    server and third-party connectors. Discovered via RFC 8414 metadata at
    /.well-known/oauth-authorization-server and RFC 9728 protected-resource
    metadata at /.well-known/oauth-protected-resource. Access tokens may be
    mutual-TLS or DPoP sender-constrained.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.rillet.com/oauth2/authorize
    tokenUrl: https://api.rillet.com/oauth2/token
    revocationUrl: https://api.rillet.com/oauth2/revoke
    introspectionUrl: https://api.rillet.com/oauth2/introspect
    jwksUri: https://api.rillet.com/oauth2/jwks
    pkce: S256
    scopes:
      read: Read access to Rillet resources
      write: Write access to Rillet resources
  sender_constrained:
    mtls: true
    dpop: true
  sources:
  - well-known/rillet-oauth-authorization-server.json
  - well-known/rillet-oauth-protected-resource.json