Salesloft Authentication

generated: '2026-08-13'
method: searched
source: https://developers.salesloft.com/docs/platform/api-basics/
docs: https://developers.salesloft.com/docs/platform/api-basics/oauth-authentication/
description: >-
  Salesloft's authentication profile, read from the provider's own API Basics pages and the
  live OAuth/OIDC discovery documents. This UPGRADES the earlier derived file: the
  Postman-derived OpenAPI in openapi/ declares three malformed schemes (noauthAuth,
  bearerAuth, and an "oauth2" scheme typed as http with no flows and no URLs), which
  describes the wire format but not the authorization model. Everything below is from the
  docs and from probed discovery metadata.

summary:
  types: [oauth2, openIdConnect, apiKey]
  transport: 'Authorization: Bearer <token> on every request (both OAuth access tokens and API keys)'
  api_key_in: [header]
  oauth2_flows: [authorizationCode, clientCredentials]
  token_lifetime_seconds: 7200
  partner_requirement: 'OAuth only — partner applications submitted using API keys will not be approved.'

schemes:
  - name: oauth-authorization-code
    type: oauth2
    flow: authorizationCode
    audience: 'Public/partner applications and private team applications where an end user authorizes'
    authorizationUrl: https://accounts.salesloft.com/oauth/authorize
    tokenUrl: https://accounts.salesloft.com/oauth/token
    request_parameters: [client_id, client_secret, code, grant_type, redirect_uri]
    token_response: [access_token, token_type, expires_in, refresh_token, scope, created_at]
    refresh:
      supported: true
      rotating: true
      detail: 'On receipt of a refresh token all old refresh tokens are revoked; the new refresh_token must be stored.'
    app_registration: 'Salesloft Account > Your Applications > OAuth Applications > Create New'
    docs: https://developers.salesloft.com/docs/platform/api-basics/oauth-authentication/
  - name: oauth-client-credentials
    type: oauth2
    flow: clientCredentials
    audience: 'Private, admin-enabled applications only. Cannot be allowlisted; assumes the permissions of the admin who created the application.'
    tokenUrl: https://accounts.salesloft.com/oauth/token
    request_parameters: [client_id, client_secret, grant_type, scope]
    client_auth_methods: [body-parameters, 'HTTP Basic (base64 client_id:client_secret)']
    scope_delimiter: space
    refresh:
      supported: false
      detail: 'No refresh_token is issued; request a new token every 7200 seconds.'
    docs: https://developers.salesloft.com/docs/platform/api-basics/client-creds/
  - name: api-key
    type: apiKey
    in: header
    parameter: Authorization
    format: 'Bearer <key>. Keys take the form "ak" followed by a 64-character hexadecimal string.'
    audience: 'Customers only. Acts on behalf of the issuing user. Not accepted for partner applications.'
    scoped: true
    scope_detail: 'A key is created with an explicit scope selection; the Save action stays disabled until at least one scope is chosen. Scopes on an existing key can be edited.'
    provisioning: 'Salesloft Account > Your Applications > API Keys > Create New'
    revocation: 'Delete the key from Your Applications > API Keys.'
    docs: https://developers.salesloft.com/docs/platform/api-basics/api-key-authentication/
  - name: openid-connect
    type: openIdConnect
    openIdConnectUrl: https://accounts.salesloft.com/.well-known/openid-configuration
    issuer: https://accounts.salesloft.com
    authorization_endpoint: https://accounts.salesloft.com/oidc/authorize
    token_endpoint: https://accounts.salesloft.com/oidc/token
    userinfo_endpoint: https://accounts.salesloft.com/oidc/userinfo
    jwks_uri: https://accounts.salesloft.com/oidc/discovery/keys
    id_token_signing_alg: [RS256]
    scopes_supported: ['system:all', 'external_emails:create', openid]
    claims_supported: [iss, sub, aud, exp, iat, account_id, team_admin, username, region, team_id, given_name, family_name, updated_at, email, user_guid, name, email_verified]
    note: 'Identity/SSO surface, distinct from Platform API authorization. Probed live, not documented in the developer docs.'
  - name: mcp-oauth
    type: oauth2
    flow: authorizationCode
    resource: https://mcp.salesloft.com
    metadata: https://mcp.salesloft.com/.well-known/oauth-authorization-server
    protected_resource_metadata: https://mcp.salesloft.com/.well-known/oauth-protected-resource
    dynamic_client_registration: https://accounts.salesloft.com/oauth/client/register
    pkce: [S256, plain]
    note: 'The remote MCP server is an RFC 9728 protected resource and supports RFC 7591 dynamic client registration — neither is offered on the REST API.'

spec_schemes_observed:
  note: >-
    Retained for traceability. These are what the harvested OpenAPI actually declares, and they
    are wrong: an OAuth 2.0 scheme cannot be type http, and "noauth" is not an HTTP auth scheme.
    They are an artifact of a Postman export, not of Salesloft's authorization model.
  schemes:
    - {name: noauthAuth, type: http, scheme: noauth, sources: ['openapi/_original/salesloft-openapi.yml']}
    - {name: bearerAuth, type: http, scheme: bearer, sources: ['openapi/_original/salesloft-openapi.yml']}
    - {name: oauth2Auth, type: http, scheme: oauth2, sources: ['openapi/_original/salesloft-openapi.yml']}

errors:
  missing_token: '401 {"error":"No Bearer Token attached to request, please see documentation at developers.salesloft.com"}'
  invalid_grant: '{"error":"invalid_grant","error_description":"The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request"}'

related:
  scopes: scopes/salesloft-scopes.yml
  conventions: conventions/salesloft-conventions.yml
  well_known: well-known/salesloft-well-known.yml

x-evidence:
  fetched: '2026-08-13'
  probes:
    - {url: 'https://developers.salesloft.com/docs/platform/api-basics/oauth-authentication/', status: 200}
    - {url: 'https://developers.salesloft.com/docs/platform/api-basics/client-creds/', status: 200}
    - {url: 'https://developers.salesloft.com/docs/platform/api-basics/api-key-authentication/', status: 200}
    - {url: 'https://accounts.salesloft.com/.well-known/openid-configuration', status: 200}
    - {url: 'https://api.salesloft.com/v2/openapi.json', status: 401, note: 'every api.salesloft.com path requires a bearer token'}