Singular Authentication

generated: '2026-08-12'
method: searched
source: >-
  https://support.singular.net/hc/en-us/articles/360045245692-Reporting-API-Reference +
  https://support.singular.net/hc/en-us/articles/53262822713755-Custom-Fraud-Rules-API-Reference +
  https://support.singular.net/hc/en-us/articles/37923459892507-Singular-MCP +
  https://mcp.singular.net/.well-known/oauth-authorization-server (200) +
  live probes of api.singular.net and s2s.singular.net
docs: https://support.singular.net/hc/en-us/articles/207553433-Getting-Started-with-the-Singular-Reporting-API
summary:
  types: [apiKey, oauth2]
  api_key_in: [query, header]
  oauth2_flows: [authorizationCode]
schemes:
  - name: apiKey-query
    type: apiKey
    in: query
    parameter: api_key
    applies_to:
      - Reporting API (api.singular.net/api/v2.0/)
      - SKAdNetwork API
      - Ad Monetization API
      - Singular Links API
      - Custom Fraud Rules API
      - Publisher Blacklist API
      - Partner Configuration Changes Log API
      - Testing Console API
    description: >-
      "All API requests require an API key. To retrieve the key, log into your account and go
      to Developer Tools > API Keys. You can insert the key in the api_key parameter in your
      request, or provide the token under an Authorization HTTP header."
    sources: [docs:support.singular.net/360045245692, docs:support.singular.net/360056377792]
  - name: apiKey-authorization-header
    type: apiKey
    in: header
    parameter: Authorization
    bearer_prefix: false
    description: >-
      The same account API key may be sent as a bare Authorization header value. Singular's
      Custom Fraud Rules reference is explicit: "Put the API key in the authorization HTTP
      header ... Do not prefix the header value with Bearer." Singular's own Python client
      (singular-labs/singular_api_client) sends `headers = {"Authorization": self.api_key}`.
    sources:
      - docs:support.singular.net/53262822713755
      - https://github.com/singular-labs/singular_api_client/blob/master/singular_api_client/singular_client.py
  - name: sdk-key
    type: apiKey
    in: sdk-configuration
    parameter: SDK Key / SDK Secret
    applies_to: [iOS/Android/Unity/Flutter/React Native/Cordova/Web SDKs, Server-to-Server endpoints]
    description: >-
      Client-side attribution SDKs and the s2s.singular.net ingestion endpoints authenticate
      with an SDK Key (and the `a` parameter on S2S calls), issued per app from the Singular
      console. This is a distinct credential from the server-side Reporting API key.
    sources: [docs:support.singular.net/31394799175963, docs:support.singular.net/31496864868635]
  - name: oauth2-mcp
    type: oauth2
    applies_to: [Singular MCP (mcp.singular.net/mcp-server/mcp)]
    flows:
      - flow: authorizationCode
        authorizationUrl: https://mcp.singular.net/oauth_server/authorize
        tokenUrl: https://mcp.singular.net/oauth_server/token
        registrationUrl: https://mcp.singular.net/oauth_server/register
        scopes: [mcp:read]
        pkce: [S256]
        token_endpoint_auth_methods: [client_secret_post, none]
        dynamic_client_registration: true
    description: >-
      The Singular MCP server is a full OAuth 2.1-style protected resource: RFC 8414
      authorization-server metadata, RFC 9728 protected-resource metadata, RFC 7591 dynamic
      client registration, PKCE S256, and a published JWKS at
      https://mcp.singular.net/.well-known/jwks.json. Bearer token in the Authorization
      header; a call without one returns 401 with a WWW-Authenticate challenge naming the
      resource metadata document.
    sources:
      - https://mcp.singular.net/.well-known/oauth-authorization-server
      - https://mcp.singular.net/.well-known/oauth-protected-resource
      - docs:support.singular.net/37923459892507
  - name: oauth2-wordpress-mcp
    type: oauth2
    applies_to: [www.singular.net/wp-json/mcp/mcp-oauth-server]
    flows:
      - flow: authorizationCode
        authorizationUrl: https://www.singular.net/oauth/authorize
        tokenUrl: https://www.singular.net/oauth/token
        revocationUrl: https://www.singular.net/oauth/revoke
        scopes: [mcp]
        pkce: [S256]
        token_endpoint_auth_methods: [none]
    description: >-
      A second OAuth authorization server advertised by the WordPress marketing site for its
      WP MCP adapter endpoint. Separate from the product MCP above.
    sources:
      - https://www.singular.net/.well-known/oauth-authorization-server
      - https://www.singular.net/.well-known/oauth-protected-resource
console_access:
  mfa: true
  sso: true
  note: >-
    "Singular supports 2FA as well as SSO" (SSO is listed as an Enterprise-plan feature on
    the pricing page).
  source: https://www.singular.net/data-security-privacy/
x-evidence:
  - {url: 'https://api.singular.net/api/v2.0/reporting', http_status: 401, body: '{"status": 1, "substatus": 1, "value": "Missing API Key"}', fetched: '2026-08-12'}
  - {url: 'https://api.singular.net/api/v1/fraud/rules/meta', http_status: 401, body: '{"status": 1, "substatus": 1, "value": "Missing API Key"}', fetched: '2026-08-12'}
  - {url: 'https://mcp.singular.net/mcp-server/mcp', http_status: 401, body: 'invalid_token (WWW-Authenticate Bearer)', fetched: '2026-08-12'}
notes: >-
  No OpenAPI/Swagger document is published on any Singular host, so this profile is read from
  the provider's prose reference plus live probes and the published OAuth metadata rather
  than from securitySchemes. No OpenID Connect discovery document is served
  (/.well-known/openid-configuration is 404 on every host including mcp.singular.net).