Serviceup Authentication

generated: '2026-08-05'
method: searched
source: https://auth.serviceup.com/.well-known/oauth-authorization-server
docs: null
note: >-
  ServiceUp publishes no developer documentation for its API. This profile is built
  entirely from the machine-readable OAuth metadata the provider serves anonymously
  (RFC 8414 authorization-server metadata and RFC 9728 protected-resource metadata),
  plus the WWW-Authenticate challenge returned by the MCP endpoint itself. No
  OpenAPI or securitySchemes were found to derive from.
summary:
  types:
  - oauth2
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  bearer_methods:
  - header
  pkce: required-by-metadata
schemes:
- name: ServiceUpOAuth2
  type: oauth2
  description: >-
    OAuth 2.1 authorization-code flow with PKCE protecting the ServiceUp MCP server.
    Access tokens are presented as a Bearer token in the Authorization header.
  sources:
  - well-known/serviceup-oauth-authorization-server.json
  - well-known/serviceup-oauth-protected-resource-mcp.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.serviceup.com/api/auth/oauth2/authorize
    tokenUrl: https://auth.serviceup.com/api/auth/oauth2/token
    scopes:
    - mcp:read
    - mcp:write
    - offline_access
authorization_server:
  issuer: https://auth.serviceup.com
  metadata_url: https://auth.serviceup.com/.well-known/oauth-authorization-server
  authorization_endpoint: https://auth.serviceup.com/api/auth/oauth2/authorize
  token_endpoint: https://auth.serviceup.com/api/auth/oauth2/token
  jwks_uri: https://auth.serviceup.com/api/auth/jwks
  registration_endpoint: null
  dynamic_client_registration: false
  response_types_supported:
  - code
  grant_types_supported:
  - authorization_code
  - refresh_token
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  - none
  code_challenge_methods_supported:
  - S256
  scopes_supported:
  - mcp:read
  - mcp:write
  - offline_access
protected_resources:
- resource: https://api.serviceup.com/mcp
  metadata_url: https://api.serviceup.com/.well-known/oauth-protected-resource/mcp
  authorization_servers:
  - https://auth.serviceup.com
  scopes_supported:
  - mcp:read
  - mcp:write
  bearer_methods_supported:
  - header
signing_keys:
  jwks_url: https://auth.serviceup.com/api/auth/jwks
  file: well-known/serviceup-jwks.json
  algorithms:
  - EdDSA
  curves:
  - Ed25519
  key_count: 1
observations:
- >-
  No registration_endpoint is advertised, so RFC 7591 dynamic client registration is
  not available; MCP clients need a client_id issued out of band by ServiceUp.
- >-
  token_endpoint_auth_methods_supported includes "none", which permits public clients
  using PKCE.
- >-
  No /.well-known/openid-configuration is served (auth.serviceup.com returns a Next.js
  HTML 404 page), so this is plain OAuth 2.1, not OpenID Connect.
x-evidence:
- url: https://auth.serviceup.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json
  fetched: '2026-08-05'
- url: https://api.serviceup.com/.well-known/oauth-protected-resource/mcp
  http_status: 200
  content_type: application/json; charset=utf-8
  fetched: '2026-08-05'
- url: https://auth.serviceup.com/api/auth/jwks
  http_status: 200
  content_type: application/json
  fetched: '2026-08-05'
- url: https://auth.serviceup.com/.well-known/openid-configuration
  http_status: 404
  content_type: text/html; charset=utf-8
  fetched: '2026-08-05'
- url: https://auth.serviceup.com/api/auth/oauth2/register
  http_status: 404
  fetched: '2026-08-05'