generated: '2026-09-25'
method: searched
source:
- https://api.aiapplyd.com/api/v1/openapi.json
- https://mcp.aiapplyd.com/.well-known/oauth-authorization-server
- https://mcp.aiapplyd.com/.well-known/oauth-protected-resource
schemes:
- name: BearerAuth
  type: http
  scheme: bearer
  applies_to: AI Applyd API (api.aiapplyd.com/api/v1)
  description: 'Session token from signing in to AI Applyd, sent as `Authorization: Bearer <token>` (the contract''s own components.securitySchemes.BearerAuth
    description).'
  note: Declared in components.securitySchemes and applied as the top-level security requirement since the 2026-09-25 contract;
    on 2026-09-23 it was referenced but undeclared.
- name: x-api-key
  type: apiKey
  in: header
  applies_to: internal service-to-service route /mcp/session (the /internal/* routes left the public contract on 2026-09-25)
  description: Operation descriptions say "Internal (x-api-key)".
- name: MCP OAuth
  type: oauth2
  applies_to: AI Applyd MCP Server (mcp.aiapplyd.com/mcp)
  flows:
    authorizationCode:
      authorizationUrl: https://mcp.aiapplyd.com/authorize
      tokenUrl: https://mcp.aiapplyd.com/oauth/token
      refreshUrl: https://mcp.aiapplyd.com/oauth/token
  pkce: S256
  registration_endpoint: https://mcp.aiapplyd.com/register
  revocation_endpoint: https://mcp.aiapplyd.com/oauth/revoke
  token_endpoint_auth_methods:
  - none
  bearer_methods:
  - header
  scopes:
  - openid
  - email
  - profile
  - offline_access
  client_id_metadata_document_supported: true
  authorization_response_iss_parameter_supported: true
summary: REST backend uses session bearer tokens (BearerAuth, declared in the contract); the MCP server is an OAuth 2.1 protected
  resource (RFC 9728) with public clients, PKCE, dynamic client registration, Client ID Metadata Documents and the RFC 9207
  iss parameter.
docs: https://aiapplyd.com/mcps