Treasury · Authentication Profile

Treasury Authentication

Authentication

Treasury secures its APIs with oauth2 across 1 declared security scheme, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

CompanyInvestingPersonal FinanceFintechBrokerageFinancial EducationMCPAgent
Methods: oauth2 Schemes: 1 OAuth flows: authorizationCode API key in:

Security Schemes

OAuth2 oauth2
· flows: authorizationCode

Source

Authentication Profile

treasury-authentication.yml Raw ↑ 
generated: '2026-07-21'
method: searched
source: https://treasury.app/.well-known/oauth-authorization-server
summary:
  types: [oauth2]
  oauth2_flows: [authorizationCode]
  pkce: [S256]
  dynamic_client_registration: true
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://treasury.app/oauth/authorize
    tokenUrl: https://treasury.app/oauth/token
    registrationUrl: https://treasury.app/oauth/register   # RFC 7591 dynamic client registration
    pkce: S256
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
    scopes:
    - scope: mcp:connect
      description: Connect to the Treasury Model Context Protocol (MCP) server.
  sources: [well-known/treasury-oauth-authorization-server.json]
notes: >-
  Auth profile derived from Treasury's published RFC 8414 OAuth Authorization
  Server Metadata. This OAuth server guards the hosted MCP server at
  https://treasury.app/mcp. No traditional API-key or OpenAPI security scheme is
  published (the consumer app has no public REST developer platform).