generated: '2026-08-11'
method: searched
source: https://admakeai.com/.well-known/oauth-authorization-server; https://admakeai.com/.well-known/oauth-protected-resource/api/mcp;
  https://admakeai.com/.well-known/mcp.json; https://github.com/mesmerlord/admakeai-mcp README; skills/admakeai-api.md
docs: https://admakeai.com/agents
note: >-
  Derived without an OpenAPI — AdMakeAI publishes no spec, so the security schemes below are read from the provider's
  own OAuth metadata documents (probed live) and its published MCP server card and agent skill, not from a
  securitySchemes block. Both surfaces (REST /api/v1 and MCP /api/mcp) sit on one account and one credit pool.
summary:
  types: [apiKey, http, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
schemes:
  - name: apiKey
    type: apiKey
    in: header
    parameter: x-api-key
    applies_to: [REST /api/v1, MCP /api/mcp]
    issued_at: https://admakeai.com/dashboard/integrations/api
    key_prefix: amai_live_
    key_prefix_source: https://github.com/mesmerlord/admakeai-agent-skills README (documented example, not a live key)
    constraints:
      max_active_keys_per_account: 5
      revocable: true
      expiry: optional
    source: https://admakeai.com/.well-known/mcp.json
  - name: bearerApiKey
    type: http
    scheme: bearer
    note: 'The same account API key may be presented as `Authorization: Bearer <key>` instead of `x-api-key`.'
    source: skills/admakeai-api.md
  - name: oauth2
    type: oauth2
    profile: OAuth 2.1 / MCP authorization
    issuer: https://admakeai.com
    flows:
      - flow: authorizationCode
        authorizationUrl: https://admakeai.com/oauth/authorize
        tokenUrl: https://admakeai.com/api/oauth/token
        revocationUrl: https://admakeai.com/api/oauth/revoke
        registrationUrl: https://admakeai.com/api/oauth/register
        pkce: [S256]
        scopes: [mcp:read, mcp:write, mcp:publish, offline_access]
    applies_to: [MCP /api/mcp]
    source: https://admakeai.com/.well-known/oauth-authorization-server
discovery:
  authorization_server_metadata: https://admakeai.com/.well-known/oauth-authorization-server
  protected_resource_metadata: https://admakeai.com/.well-known/oauth-protected-resource/api/mcp
  specs: [RFC 8414, RFC 9728, RFC 7591, RFC 7636]
  dynamic_client_registration: true
  client_id_metadata_document_supported: true
  token_endpoint_auth_methods_supported: [none, client_secret_post, client_secret_basic]
  response_types_supported: [code]
  grant_types_supported: [authorization_code, refresh_token]
  challenge: >-
    The provider documents that an unauthenticated MCP call answers 401 with a WWW-Authenticate resource_metadata
    pointer. This could not be observed from here: an anonymous POST to https://admakeai.com/api/mcp returns HTTP 403
    with a Cloudflare managed challenge before the application is reached.
authorization:
  model: scope-filtered tools
  detail: >-
    Scope is enforced at tools/list, not only at call time — a connection approved without mcp:publish never sees the
    pause/resume tools. Grants are listed and revocable from the dashboard Integrations section.
  artifact: scopes/admakeai-scopes.yml
x-evidence:
  fetched: '2026-08-11'
  probes:
    - url: https://admakeai.com/.well-known/oauth-authorization-server
      http_status: 200
    - url: https://admakeai.com/.well-known/oauth-protected-resource/api/mcp
      http_status: 200
    - url: https://admakeai.com/api/mcp
      http_status: 403
      note: Cloudflare managed challenge on an anonymous JSON-RPC POST.