The Mobile First Company Authentication

generated: '2026-07-21'
method: searched
docs: https://help.withallo.com/en/v2/api-reference/guides/authentication
source: >-
  openapi/the-mobile-first-company-allo-openapi.json securitySchemes +
  Allo authentication guide + OAuth authorization-server metadata
api: Allo API
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
primary: api_key
description: >-
  Every Allo API request requires authentication in the Authorization header.
  The primary method is a scoped API key (Settings > API) sent as
  `Authorization: Api-Key ak_live_<key>`. OAuth 2.0 is additionally supported
  for OAuth clients and the hosted MCP server (authorization server
  api.withallo.com). API access is not available on trial plans.
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: Authorization
  format: 'Api-Key ak_live_<key>'
  description: >-
    Scoped API key. Live keys use the ak_live_ prefix. Keys are scoped to a
    single team, can be revoked at any time, and carry one or more of the scopes
    in scopes/the-mobile-first-company-scopes.yml. Per-endpoint scope
    requirements are documented in the authentication guide's scope-to-endpoint
    mapping.
  sources:
  - openapi/the-mobile-first-company-allo-openapi.json
  - https://help.withallo.com/en/v2/api-reference/guides/authentication
- name: OAuth2
  type: oauth2
  flows:
  - authorization_code (PKCE S256)
  - client_credentials
  - refresh_token
  authorization_endpoint: https://api.withallo.com/v1/oauth/authorize
  token_endpoint: https://api.withallo.com/v1/oauth/token
  revocation_endpoint: https://api.withallo.com/v1/oauth/revoke
  description: >-
    OAuth 2.0 (RFC 8414 metadata at
    well-known/the-mobile-first-company-oauth-authorization-server.json). Used by
    the Claude Connector and other OAuth clients; the hosted MCP server is an
    OAuth protected resource against this authorization server.
  sources:
  - well-known/the-mobile-first-company-oauth-authorization-server.json
  - https://www.withallo.com/mcp
spec_scheme_aliases:
  note: >-
    The spec also exposes scope-specific apiKey scheme aliases, all sent in the
    Authorization header and differing only by the scope the key must carry.
  aliases:
  - name: CallsAuth
    scope: CONVERSATIONS_READ
  - name: ContactsAuth
    scope: CONTACTS_READ
  - name: ContactsWriteAuth
    scope: CONTACTS_READ_WRITE
  - name: SmsAuth
    scope: SMS_SEND
errors:
  invalid_key:
    status: 401
    code: API_KEY_INVALID
  insufficient_scope:
    status: 403
    code: API_KEY_INSUFFICIENT_SCOPE
  trial_not_allowed:
    status: 403
    code: API_KEY_TRIAL_NOT_ALLOWED