generated: '2026-07-17'
method: searched
source: https://www.alloovium.com/en/developers/authentication
docs: https://www.alloovium.com/en/developers/authentication
summary:
  types: [apiKey, oauth2]
  api_key_in: [header]
  oauth2_flows: [authorizationCode]
schemes:
- name: ApiKeyAuth
  type: apiKey
  in: header
  parameter: Authorization
  format: 'Authorization: Bearer <key>'
  key_prefixes: [ak_live_, ak_test_]
  key_length: 60
  notes: >-
    Keys are rejected in query strings, cookies, or JSON bodies — header only. Test and live keys are
    created in the Developer Console.
- name: OAuth2
  type: oauth2
  version: OAuth 2.1
  flows:
  - flow: authorizationCode
    pkce: required (S256)
    authorizationUrl: https://api.alloovium.com/api/v2/oauth/authorize
    tokenUrl: https://api.alloovium.com/api/v2/oauth/token
    registrationUrl: https://api.alloovium.com/api/v2/oauth/register
    revocationUrl: https://api.alloovium.com/api/v2/oauth/revoke
  dynamic_client_registration: true
  dcr_note: >-
    Clients self-register without pre-provisioning; dynamically registered clients are always issued
    read-only scopes.
  note: OAuth tokens are not accepted on the MCP transport (API key only there).