Unruly Studios · Authentication Profile

Unruly Studios Authentication

Authentication

Unruly Studios declares 3 security scheme(s) across its OpenAPI definitions.

CompanyEducationSTEMEdTechCodingKidsLearningHardware

Methods: Schemes: 3 OAuth flows: API key in:

Security Schemes

oauth2

· flows: , ,

openIdConnect

access_token apiKey

· in: query ()

Source

Authentication Profile

generated: '2026-07-21'
method: searched
source: https://gamelocker.unruly-studios.com/.well-known/openid-configuration
notes: >-
  Unruly's "Gamelocker" project-storage backend (gamelocker.unruly-studios.com)
  is a self-hosted GitLab instance and exposes GitLab's standard OAuth 2.0 /
  OpenID Connect authorization server. The client library used by the Unruly
  Splats app (UnrulyGamelocker.js) authenticates against /oauth/token and calls
  the GitLab REST API at /api/v4 with a bearer/query access_token. These are
  GitLab-native auth mechanisms, not a bespoke Unruly auth scheme.
schemes:
- id: gamelocker_oauth2
  type: oauth2
  description: GitLab OAuth 2.0 authorization server on the Gamelocker host.
  flows:
    authorization_code:
      authorization_url: https://gamelocker.unruly-studios.com/oauth/authorize
      token_url: https://gamelocker.unruly-studios.com/oauth/token
      refresh_url: https://gamelocker.unruly-studios.com/oauth/token
    client_credentials:
      token_url: https://gamelocker.unruly-studios.com/oauth/token
    password:
      token_url: https://gamelocker.unruly-studios.com/oauth/token
      note: >-
        The Resource Owner Password Credentials grant is enabled on this
        instance and is what UnrulyGamelocker.js uses today.
  grant_types:
  - authorization_code
  - implicit
  - password
  - client_credentials
  - refresh_token
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
- id: gamelocker_oidc
  type: openIdConnect
  description: GitLab OpenID Connect provider on the Gamelocker host.
  openid_configuration: https://gamelocker.unruly-studios.com/.well-known/openid-configuration
  issuer: https://gamelocker.unruly-studios.com
  jwks_uri: https://gamelocker.unruly-studios.com/oauth/discovery/keys
  userinfo_endpoint: https://gamelocker.unruly-studios.com/oauth/userinfo
  id_token_signing_alg: RS256
- id: gamelocker_access_token
  type: apiKey
  in: query
  name: access_token
  description: >-
    GitLab personal/OAuth access token passed as an access_token query
    parameter (or Authorization bearer header) on /api/v4 requests.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/unruly-studios-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.