generated: '2026-08-13'
method: probed
source: >-
  https://beacons.ai/.well-known/oauth-authorization-server (RFC 8414, 200),
  https://beacons.ai/.well-known/oauth-protected-resource (RFC 9728, 200), and the
  WWW-Authenticate challenge returned by
  https://beacons.ai/api/v001/creator/mcp
summary: >-
  Beacons.ai has no documented API authentication page. Everything below is read
  from the two machine-readable OAuth discovery documents the platform actually
  serves. They describe a single OAuth 2.1 authorization server at
  https://beacons.ai protecting one resource — the Creator MCP endpoint.
schemes:
- id: beacons_oauth
  type: oauth2
  flow: authorizationCode
  pkce: required
  pkce_methods: [S256]
  issuer: https://beacons.ai
  authorization_url: https://beacons.ai/api/v001/oauth/authorize
  token_url: https://beacons.ai/api/v001/oauth/token
  registration_url: https://beacons.ai/api/v001/oauth/register
  dynamic_client_registration: true
  response_types: [code]
  grant_types: [authorization_code]
  token_endpoint_auth_methods: [none, client_secret_post]
  scopes:
  - name: mcp:read
    description: >-
      The only scope the authorization server advertises. Read access to the
      creator MCP resource. Beacons publishes no scope reference page, so no
      further description is available and none has been invented.
  applies_to:
  - https://beacons.ai/api/v001/creator/mcp
  bearer_methods: [header]
  note: >-
    "none" in token_endpoint_auth_methods is the public-client case that pairs with
    PKCE — it is the expected shape for an MCP client, not a missing credential
    check. No refresh_token grant is advertised, so a token is not documented as
    renewable without re-consent.
not_found:
- api-key issuance page
- personal access tokens
- OpenID Connect discovery (/.well-known/openid-configuration returns 404)
- mutual TLS
- any human-readable authentication documentation on beacons.ai or
  help.beacons.ai