Wisdom Ai Authentication

generated: '2026-07-21'
method: searched
source: https://docs.wisdom.ai/integrations/graphql-api/GraphQL-API
docs: https://docs.wisdom.ai/settings/api-keys
summary:
  types: [apiKey, http, oauth2]
  api_key_in: [header]
  http_scheme: bearer
  oauth2_flows: [authorizationCode]
  identity_provider: Descope
schemes:
- name: API access key
  type: apiKey
  description: >-
    Every WisdomAI user can create and manage their own long-lived API access
    keys from the API Keys settings page. The access key is a bearer credential
    exchanged for a short-lived JWT session token via the exchangeAccessToken
    GraphQL query; the raw access key is a server-side secret and must never
    reach the browser.
  docs: https://docs.wisdom.ai/settings/api-keys
- name: JWT session token (Bearer)
  type: http
  scheme: bearer
  description: >-
    Short-lived JWT session token (issued by Descope) passed as
    "Authorization: Bearer YOUR_SESSION_TOKEN" on every GraphQL request and in
    WebSocket subscription connection payloads. Obtained by exchanging an API
    access key with the exchangeAccessToken query.
  operations: [exchangeAccessToken]
- name: Embedded user impersonation
  type: http
  scheme: bearer
  description: >-
    For embedding scenarios, the backend uses @wisdomai/node to mint a
    short-lived per-user JWT (via impersonateUser with a Descope management key),
    which WisdomProvider consumes in the browser and auto-refreshes before expiry.
  operations: [impersonateUser]
- name: MCP OAuth 2.1
  type: oauth2
  description: >-
    The hosted MCP server authenticates with OAuth 2.1 using Dynamic Client
    Registration (DCR) and PKCE; clients register automatically with no manual
    setup. Discovery at /.well-known/oauth-protected-resource and
    /.well-known/oauth-authorization-server.
  flows:
  - flow: authorizationCode
    pkce: true
    dynamic_client_registration: true
  docs: https://docs.wisdom.ai/integrations/mcp-server/MCP-Server