generated: '2026-08-09'
method: searched
source: https://app.1lookup.io/api
docs: https://app.1lookup.io/api
description: >-
  1Lookup runs two distinct authentication models: a static API key presented as an HTTP Bearer token on
  the REST API, and OAuth 2.1 (authorization code + PKCE, with dynamic client registration) on the hosted
  MCP connector. Derived by hand from the published reference and the live RFC 8414 / RFC 9728 metadata —
  the provider publishes no OpenAPI securitySchemes to derive from mechanically.
summary:
  types: [http, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
schemes:
  - name: bearerApiKey
    type: http
    scheme: bearer
    in: header
    header: Authorization
    format: 'Authorization: Bearer YOUR_API_KEY'
    applies_to: https://app.1lookup.io/api/v1
    issued_from: 1Lookup dashboard (https://app.1lookup.io) — API keys section
    sources: [https://app.1lookup.io/api]
    notes:
      - All REST requests must carry a valid API key in the Authorization header.
      - Docs advise environment-variable storage, no client-side exposure, and periodic rotation.
      - Rate limits and credit balance are enforced per organization, not per key.
  - name: mcpOAuth21
    type: oauth2
    applies_to: https://app.1lookup.io/api/mcp
    flows:
      - flow: authorizationCode
        authorizationUrl: https://app.1lookup.io/api/mcp/oauth/authorize
        tokenUrl: https://app.1lookup.io/api/mcp/oauth/token
        registrationUrl: https://app.1lookup.io/api/mcp/oauth/register
        pkce: [S256]
        token_endpoint_auth_methods: [none]
        grant_types: [authorization_code, refresh_token]
        scopes:
          lookup: Access to the 1Lookup MCP tool set, billed to the authorizing account's plan credits
    sources:
      - well-known/1lookup-oauth-authorization-server.json
      - well-known/1lookup-oauth-protected-resource.json
    notes:
      - No API key changes hands; the MCP client receives a scoped, revocable token.
      - Bearer token is presented in the Authorization header (bearer_methods_supported = header).
      - Access can be revoked from the 1Lookup account at any time.
platform_controls:
  mfa: 'Multi-factor authentication (MFA) on the dashboard — https://www.1lookup.io/security'
  rbac: 'Role-based access control — https://www.1lookup.io/security'
  session: 'Secure JWT with refresh tokens — https://www.1lookup.io/security'
x-evidence:
  - url: https://app.1lookup.io/api
    http_status: 200
    fetched: '2026-08-09'
  - url: https://app.1lookup.io/.well-known/oauth-authorization-server
    http_status: 200
    fetched: '2026-08-09'
  - url: https://www.1lookup.io/security
    http_status: 200
    fetched: '2026-08-09'