Xbow · Authentication Profile

Xbow Authentication

Authentication

Xbow secures its APIs with http across 1 declared security scheme, as derived from its OpenAPI definitions.

SecurityPenetration TestingOffensive SecurityArtificial IntelligenceVulnerability ManagementCybersecurityApplication Security
Methods: http Schemes: 1 OAuth flows: API key in:

Security Schemes

Authorization http
scheme: bearer

Source

Authentication Profile

Raw ↑ 
generated: '2026-07-21'
method: searched
source: openapi/xbow-openapi-original.json
docs: https://docs.xbow.com/api/#description/accessing-the-api
summary:
  types:
  - http
  scheme: bearer personal access token (PAT)
schemes:
- name: Authorization
  type: http
  scheme: bearer
  bearerFormat: API Key
  description: Authorization header with Bearer token
  sources:
  - openapi/xbow-openapi-original.json
details:
  token_type: Personal Access Token, organization-scoped
  issuance: Console (console.xbow.com) > profile > Settings > Personal Access Tokens >
    Generate new token; requires organization administrator access; shown once.
  organization_keys: POST /api/v1/organizations/{organizationId}/keys creates org keys;
    DELETE /api/v1/keys/{keyId} revokes them.
  required_headers:
  - 'Authorization: Bearer <token>'
  - 'X-XBOW-API-Version: <YYYY-MM-DD>'
  restrictions: Lightspeed organizations get read-only API access (GET endpoints only).
  guidance: Store keys in env vars/secret managers, never commit to version control,
    rotate periodically, revoke compromised keys immediately.
  console_sso: SSO/SCIM available for Console user auth via customer IdP (Enterprise);
    not an API auth surface.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/xbow-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.