Rockerbox Authentication

generated: '2026-08-13'
method: searched
source: https://help.rockerbox.com/article/5t050dmcxv-webhooks
docs: https://help.rockerbox.com/category/enoswvfeqo-setup-and-technical-documentation
description: >-
  Rockerbox publishes no OpenAPI, so this profile could not be derived mechanically
  (0-working/derive-authentication.py needs securitySchemes). It was read from the provider's own
  documentation instead. The finding is unusual and worth stating plainly: Rockerbox's public
  ingestion endpoint has NO credential at all — it is authenticated by an opaque tenant identifier in
  the query string, issued by a human account manager. Everything richer (dashboard, exports,
  warehouse shares) sits behind account provisioning, not behind a developer credential.
summary:
  types: [tenant-identifier, session-login, warehouse-grant]
  api_key_in: [query]
  oauth2_flows: []
  oauth2_published: false
  openid_connect_published: false
  mutual_tls_published: false
  self_service_credentials: false
schemes:
- name: advertiser-id
  surface: Conversion / marketing event ingestion
  endpoint: https://webhooks.getrockerbox.com/webhook/data
  type: apiKey
  in: query
  parameter: advertiser
  description: >-
    A Rockerbox Advertiser ID passed as a query-string parameter on every POST. The docs say
    explicitly "You will need the following field from Rockerbox. Please ask your account manager for
    this field." There is no rotation, expiry, scope or signing documented.
  self_service: false
  rotatable: unknown
  source: https://help.rockerbox.com/article/5t050dmcxv-webhooks
  risk_note: >-
    A bare tenant identifier in a URL is an identifier, not a secret — it is not a bearer credential
    and Rockerbox does not describe it as one. Recorded as observed; no security claim is made for it.
- name: pixel-source-name
  surface: Onsite conversion / identify pixels
  type: tenantIdentifier
  in: script
  parameter: pixel source name (account ID)
  description: >-
    Client-side tracking is bound to the account by the Pixel Source Name, the public account
    identifier embedded in the tag. Documented as an account ID, not a credential.
  source: https://help.rockerbox.com/article/gdeze5itjv-pixel-source-name-account-id
- name: dashboard-login
  surface: Rockerbox application (app.rockerbox.com)
  type: session
  in: cookie
  description: >-
    Username / password session login to the Rockerbox dashboard, where users, exports and scheduled
    reports are managed. User administration is documented; no API-token issuance page was found.
  login_url: https://app.rockerbox.com/login
  source: https://help.rockerbox.com/article/n58en66w7j-forgot-password-troubleshoot-login
- name: warehouse-grant
  surface: Data Foundation warehouse share
  type: platform-native
  description: >-
    Access to the warehouse datasets is granted by the warehouse platform's own mechanism rather than
    by a Rockerbox credential — Snowflake data sharing, BigQuery project-level permissions, or
    Redshift IAM roles. Enabled by a Rockerbox representative as a paid add-on.
  source: https://data-foundation.rockerbox.com/warehousing/quickstart
- name: none
  surface: Data Foundation docs MCP server
  endpoint: https://data-foundation.rockerbox.com/mcp
  type: none
  description: >-
    The remote MCP server is anonymous. /.well-known/mcp.json declares "authentication":"none" and an
    unauthenticated initialize + tools/list handshake returned HTTP 200. Verified by probe.
  verified: probed
gaps:
- No OAuth 2.0, OpenID Connect or mutual TLS is published on any Rockerbox surface.
- No /.well-known/oauth-authorization-server or /.well-known/oauth-protected-resource is served (all 404 / soft-200).
- No developer-facing API key issuance, rotation or scope documentation was found.
- No signing, HMAC or replay protection is documented for the ingestion webhook.
x-evidence:
- {url: 'https://help.rockerbox.com/article/5t050dmcxv-webhooks', http_status: 200, fetched: '2026-08-13'}
- {url: 'https://data-foundation.rockerbox.com/warehousing/quickstart.md', http_status: 200, fetched: '2026-08-13'}
- {url: 'https://data-foundation.rockerbox.com/.well-known/mcp.json', http_status: 200, fetched: '2026-08-13'}
- {url: 'https://app.rockerbox.com/login', http_status: 200, fetched: '2026-08-13'}