StrongDM · Authentication Profile

Strongdm Authentication

Authentication

StrongDM Admin API authentication. The control-plane API is gRPC; requests are authenticated with an API access key plus secret key pair generated in the Admin UI, and each request is signed. There is no OAuth 2.0 / OpenID Connect authorization-server surface on the API — the SDKs handle key-based signing internally, so there is no scope model (scopes/ is intentionally absent).

StrongDM secures its APIs with apiKey across 1 declared security scheme, as derived from its OpenAPI definitions.

CompanySecurityPrivileged Access ManagementZero TrustAccess ManagementIdentityInfrastructureAuditComplianceDevOps

Methods: apiKey Schemes: 1 OAuth flows: API key in: signed-request

Security Schemes

apiKeyPair apiKey

· in: header ()

Source

Authentication Profile

generated: '2026-07-21'
method: searched
source: https://docs.strongdm.com/ (API authentication) and the SDK READMEs
description: >-
  StrongDM Admin API authentication. The control-plane API is gRPC; requests are
  authenticated with an API access key plus secret key pair generated in the
  Admin UI, and each request is signed. There is no OAuth 2.0 / OpenID Connect
  authorization-server surface on the API — the SDKs handle key-based signing
  internally, so there is no scope model (scopes/ is intentionally absent).
summary:
  types: [apiKey]
  api_key_in: [signed-request]
  oauth2_flows: []
schemes:
- name: apiKeyPair
  type: apiKey
  in: header
  description: >-
    API access key + secret key. The access key is a hex-format identifier
    (e.g. auth-0123abcd...); the secret is a paired string. Both are issued when
    an API key is created in the Admin UI and are supplied to the SDK via the
    SDM_API_ACCESS_KEY and SDM_API_SECRET_KEY environment variables. The SDK
    signs each gRPC request; the secret is never sent on the wire directly.
  env:
    access_key: SDM_API_ACCESS_KEY
    secret_key: SDM_API_SECRET_KEY
  sources: [docs.strongdm.com, github.com/strongdm/strongdm-sdk-python]
notes: >-
  Human access to resources is authenticated separately through the sdm client
  and the organization's SSO/identity provider; this profile covers the Admin
  API used for automation.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/strongdm-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.