Swytchcode · Authentication Profile

Swytchcode Authentication

Authentication

Two separate authentication planes. No hosted public API — auth applies to the CLI / MCP server / Runtime SDKs.

Swytchcode declares 3 security scheme(s) across its OpenAPI definitions.

AI / Agent Toolingagentic middlewareAPI IntegrationAPI OrchestrationAPI execution layerLLM tool executionMCP ServerDeveloper ToolsAPI DocumentationAPI playground

Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

account-oauth-device-flow oauth2

account-service-token apiKey

· in: environment ()

mcp-http-bearer http

scheme: bearer

Source

Authentication Profile

generated: '2026-09-03'
method: searched
source: https://docs.swytchcode.com/guides/authentication/ , https://docs.swytchcode.com/guides/managed-authentication/ , https://docs.swytchcode.com/cli/authentication/
docs: https://docs.swytchcode.com/guides/authentication/
description: >-
  Two separate authentication planes. No hosted public API — auth applies to the CLI / MCP
  server / Runtime SDKs.
schemes:
  - name: account-oauth-device-flow
    type: oauth2
    flow: device
    description: Swytchcode account identity via `swy login` browser device flow; session stored at ~/.swytchcode/auth.json.
  - name: account-service-token
    type: apiKey
    in: environment
    key: SWYTCHCODE_TOKEN
    description: Service-token auth for CI/servers; read from process environment only (deliberately never from .env files).
  - name: mcp-http-bearer
    type: http
    scheme: bearer
    description: The optional local HTTP/SSE MCP transport requires a bearer token stored at ~/.swytchcode/mcp_token (`swy mcp token`). stdio transport needs no auth.
provider_credentials:
  description: >-
    Third-party provider credentials (OAuth, API keys, bearer tokens) are resolved separately
    from account auth, in priority order: environment variables, the encrypted managed
    credential store (WorkOS-managed auth), then the project .env file. Managed via
    `swy auth connect/status/disconnect`. Account credentials are never used against external
    providers.
  managed_by: WorkOS

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/swytchcode-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.