generated: '2026-07-18'
method: searched
source: https://docs.duplocloud.com/docs/armor/access-control/user-tokens.md
docs: https://docs.duplocloud.com/docs/armor/access-control/user-tokens.md
summary:
  types: [http]
  http_schemes: [bearer]
  api_key_in: []
  oauth2_flows: []
schemes:
  - name: userToken
    type: http
    scheme: bearer
    in: header
    header: Authorization
    format: 'Authorization: Bearer <token>'
    description: >-
      DuploCloud REST API and MCP server requests authenticate with a User Token
      (a personal access token) minted per user under Access Control > User Tokens,
      presented as an HTTP Bearer token. The same token authorizes duploctl (the
      Python SDK/CLI), the Terraform provider, and the MCP server.
    sources: [docs]
notes: >-
  DuploCloud is deployed as a dedicated per-customer portal, so the API base URL is
  organization-specific (e.g. https://<portal>.duplocloud.net). Authorization,
  permission sets, user groups, and AI guardrails are managed in the platform's
  Access Control surface rather than via OAuth scopes.