Strider Authentication

generated: '2026-08-05'
method: probed
source: https://app.striderintel.com/.well-known/oauth-authorization-server
note: >-
  Strider publishes no OpenAPI, so this profile is not derived from securitySchemes. It is
  built entirely from the provider's own RFC 8414 and RFC 9728 discovery documents plus the
  observed WWW-Authenticate challenge — machine-readable auth metadata Strider serves itself.
summary:
  types:
  - oauth2
  oauth2_flows:
  - authorizationCode
  api_key_in: []
  scopes_published: false
schemes:
- name: StriderMcpOAuth
  type: oauth2
  issuer: https://app.striderintel.com
  applies_to: https://app.striderintel.com/app-api/mcp
  sources:
  - well-known/strider-oauth-authorization-server.json
  - well-known/strider-oauth-protected-resource-mcp.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.striderintel.com/app-api/mcp/oauth/authorize
    tokenUrl: https://app.striderintel.com/app-api/mcp/oauth/token
    refreshUrl: https://app.striderintel.com/app-api/mcp/oauth/token
    scopes: {}
  registration_endpoint: https://app.striderintel.com/app-api/mcp/oauth/register
  revocation_endpoint: https://app.striderintel.com/app-api/mcp/oauth/revoke
  response_types_supported:
  - code
  grant_types_supported:
  - authorization_code
  - refresh_token
  code_challenge_methods_supported:
  - S256
  token_endpoint_auth_methods_supported:
  - none
  - client_secret_post
  revocation_endpoint_auth_methods_supported:
  - none
  - client_secret_post
  dynamic_client_registration: true
  bearer_challenge: >-
    WWW-Authenticate: Bearer
    resource_metadata="https://app.striderintel.com/.well-known/oauth-protected-resource/app-api/mcp"
- name: StriderShieldApi
  type: unknown
  applies_to: https://api.striderintel.com/
  status: gated
  note: >-
    The Shield API host answers HTTP 403 for every path including a random control path.
    No authentication scheme, key-issuance flow or reference is published anonymously, so
    none is asserted here. Strider markets Shield as "delivered via API" for SIEM/DLP
    integration; obtaining the contract requires a customer agreement.
gaps:
- No scopes_supported in the authorization server metadata — no published scope vocabulary.
- No /.well-known/openid-configuration; the server is OAuth 2.1, not OIDC.
- No public authentication documentation page for either the MCP server or the Shield API.