Sapiom · Authentication Profile

Sapiom Authentication

Authentication

Sapiom secures its APIs with http and oauth2 across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, deviceCode, and refreshToken flow(s).

CompanyArtificial IntelligenceAI AgentsAgent InfrastructureMCPAPI GatewayPaymentsAgentic CommerceDeveloper ToolsSDK

Methods: http, oauth2 Schemes: 3 OAuth flows: authorizationCode, deviceCode, refreshToken API key in: header

Security Schemes

BearerApiKey http

scheme: bearer

OAuth2 oauth2

· flows: authorizationCode, deviceCode, refreshToken

DeveloperBrowserLogin oauth2

Source

Authentication Profile

generated: '2026-07-21'
method: searched
source: https://docs.sapiom.ai/api-reference/introduction.md + https://docs.sapiom.ai/integration/sdk.md + well-known/sapiom-oauth-authorization-server.json
docs: https://docs.sapiom.ai/api-reference/introduction
summary:
  types: [http, oauth2]
  api_key_in: [header]
  http_scheme: bearer
  oauth2_flows: [authorizationCode, deviceCode, refreshToken]
schemes:
- name: BearerApiKey
  type: http
  scheme: bearer
  description: >-
    All REST API endpoints authenticate with a Bearer token: `Authorization: Bearer YOUR_API_KEY`.
    Keys are minted in the Sapiom Dashboard (https://app.sapiom.ai/settings) and read from the
    SAPIOM_API_KEY environment variable by the SDKs. Attribution (agentName) is set on the client
    to route spend to per-agent transaction history and spending rules.
  sources: [https://docs.sapiom.ai/api-reference/introduction]
- name: OAuth2
  type: oauth2
  description: >-
    The remote MCP resource (https://api.sapiom.ai/v1/mcp) is guarded by OAuth 2.0 with
    Protected Resource Metadata (RFC 9728) and Authorization Server Metadata (RFC 8414).
    Supports PKCE (S256), Dynamic Client Registration (RFC 7591), and the OAuth 2.0 Device
    Authorization Grant. Token endpoint auth method is "none" (public clients).
  issuer: https://api.sapiom.ai
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.sapiom.ai/v1/oauth/authorize
    tokenUrl: https://api.sapiom.ai/v1/oauth/token
    pkce: S256
  - flow: deviceCode
    tokenUrl: https://api.sapiom.ai/v1/oauth/token
  - flow: refreshToken
    tokenUrl: https://api.sapiom.ai/v1/oauth/token
  registration_endpoint: https://api.sapiom.ai/v1/oauth/register
  sources: [well-known/sapiom-oauth-authorization-server.json, well-known/sapiom-oauth-protected-resource.json]
- name: DeveloperBrowserLogin
  type: oauth2
  description: >-
    The local authoring MCP (@sapiom/mcp) uses sapiom_authenticate, a browser-based approval
    flow that caches the credential at ~/.sapiom/credentials.json for subsequent tool calls.
  sources: [https://docs.sapiom.ai/agents/reference]

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/sapiom-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.