VoiceOps · Authentication Profile

Voiceops Authentication

Authentication

VoiceOps secures its APIs with apiKey, oauth2, and openIdConnect across 3 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode flow(s).

CompanyAi AppsConversation IntelligenceCall CentersSales CoachingCustomer ExperienceArtificial IntelligenceSpeech AnalyticsMCPAgents

Methods: apiKey, oauth2, openIdConnect Schemes: 3 OAuth flows: authorizationCode API key in: header

Security Schemes

mcpApiKey apiKey

· in: header ()

clerkOpenIdConnect openIdConnect

clerkOAuth2 oauth2

· flows: authorizationCode

Source

Authentication Profile

generated: '2026-08-14'
method: probed
source: >-
  live probes of https://mcp.voiceops.com/mcp,
  https://clerk.voiceops.com/.well-known/openid-configuration and
  https://clerk.voiceops.com/.well-known/oauth-authorization-server
docs: null
docs_note: >-
  VoiceOps publishes no authentication documentation. There is no developer
  portal, no API reference, and no OpenAPI from which securitySchemes could be
  derived, so this profile is assembled entirely from observed behaviour of the
  live hosts.
summary:
  types: [apiKey, oauth2, openIdConnect]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
schemes:
  - name: mcpApiKey
    type: apiKey
    in: header
    parameter_name: Authorization
    applies_to: https://mcp.voiceops.com/mcp
    sources: [probe]
    description: >-
      The remote MCP server requires an Authorization header carrying a VoiceOps
      API key. Omitting it returns JSON-RPC error -32000 "Missing Authorization
      header"; a syntactically valid but unknown bearer token returns -32000
      "Invalid or unknown API key". The key format, issuance flow and rotation
      policy are not published.
  - name: clerkOpenIdConnect
    type: openIdConnect
    openIdConnectUrl: https://clerk.voiceops.com/.well-known/openid-configuration
    applies_to: https://app.voiceops.com
    sources: [well-known/voiceops-openid-configuration.json]
    description: >-
      End-user sign-in for the VoiceOps application is an OpenID Connect
      provider hosted on the VoiceOps subdomain clerk.voiceops.com (CNAME to
      frontend-api.clerk.services). This is the application login, not an API
      authorization surface for third-party developers.
    issuer: https://clerk.voiceops.com
    id_token_signing_alg_values_supported: [RS256]
    jwks_uri: https://clerk.voiceops.com/.well-known/jwks.json
  - name: clerkOAuth2
    type: oauth2
    applies_to: https://app.voiceops.com
    sources: [well-known/voiceops-oauth-authorization-server.json]
    flows:
      - flow: authorizationCode
        authorizationUrl: https://clerk.voiceops.com/oauth/authorize
        tokenUrl: https://clerk.voiceops.com/oauth/token
        revocationUrl: https://clerk.voiceops.com/oauth/token/revoke
        introspectionUrl: https://clerk.voiceops.com/oauth/token_info
        userinfoUrl: https://clerk.voiceops.com/oauth/userinfo
        refresh_supported: true
        pkce: [S256]
        token_endpoint_auth_methods: [client_secret_basic, client_secret_post, none]
        scope_count: 6
    description: >-
      RFC 8414 authorization-server metadata is served for the VoiceOps issuer.
      See scopes/voiceops-scopes.yml — the scope vocabulary is Clerk's standard
      scoped-access vocabulary, not a VoiceOps business-capability scope
      catalog.
gaps:
  - No documented way for a developer to obtain an API key.
  - No published token lifetime, rotation, or revocation guidance for the MCP API key.
  - The MCP server does not advertise /.well-known/oauth-protected-resource, so an
    MCP client cannot discover its authorization server automatically.
  - api.voiceops.com returns HTTP 404 with a JSON envelope on every anonymous path
    probed, and never issues a 401 challenge, so its authentication model could not
    be observed at all.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/voiceops-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.