Roboflow Authentication

generated: '2026-08-02'
method: searched
docs: https://docs.roboflow.com/reference/authentication/authentication.md
source: https://docs.roboflow.com/reference/platform/rest-api/authenticate-with-the-rest-api.md
summary:
  types:
  - apiKey
  - http
  - oauth2
  - openIdConnect
  api_key_in:
  - query
  - header
  - body
  oauth2_flows:
  - authorizationCode
  pkce:
  - S256
  dynamic_client_registration: true
  scoped_api_keys: true
schemes:
- name: api_key
  type: apiKey
  in: query
  parameter: api_key
  description: Workspace-scoped Roboflow API key passed as a query parameter on REST and inference calls.
  docs: https://docs.roboflow.com/reference/authentication/authentication/find-your-roboflow-api-key.md
- name: api_key_body
  type: apiKey
  in: body
  parameter: api_key
  description: The same API key may be sent in the JSON request body on POST calls.
- name: bearer
  type: http
  scheme: bearer
  description: 'Authorization: Bearer <api_key> header form accepted by the REST API, and the required
    form for OAuth access tokens on the MCP server.'
- name: oauth2
  type: oauth2
  flows:
    authorizationCode:
      authorizationUrl: https://app.roboflow.com/oauth/authorize
      tokenUrl: https://app.roboflow.com/oauth/token
      refreshUrl: https://app.roboflow.com/oauth/token
      scope_count: 67
  description: '"Sign in with Roboflow" — OAuth 2.1 authorization code + PKCE with RFC 7591 dynamic client
    registration. Used by the hosted MCP server.'
  registration_endpoint: https://app.roboflow.com/oauth/register
  introspection_endpoint: https://app.roboflow.com/oauth/introspect
  revocation_endpoint: https://app.roboflow.com/oauth/revoke
  source: well-known/roboflow-oauth-authorization-server.json
- name: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://app.roboflow.com/.well-known/openid-configuration
  issuer: https://app.roboflow.com
  jwks_uri: https://app.roboflow.com/.well-known/jwks.json
  id_token_signing_alg_values_supported:
  - RS256
  source: well-known/roboflow-openid-configuration.json
key_management:
  scoped_api_keys: https://docs.roboflow.com/reference/authentication/authentication/scoped-api-keys.md
  manage: https://docs.roboflow.com/reference/authentication/authentication/manage-api-keys.md
  console: https://app.roboflow.com/settings/api
enterprise:
  sso: https://docs.roboflow.com/platform/enterprise-features/single-sign-on-sso.md
  rbac: https://docs.roboflow.com/platform/enterprise-features/role-based-access-control.md
  scim_group_sync: Active Directory group sync for SSO (changelog, May 2026)
notes: The public Inference Server OpenAPI declares no securitySchemes — inference auth is carried by
  the api_key query parameter documented in the platform docs, not in the spec.