generated: '2026-09-07'
method: searched
source: https://docs.getelva.ai/quality-and-scoring/score-a-spec-via-api
docs: https://docs.getelva.ai/agent-ready-with-mcp/mcp-authentication-and-oauth
note: >-
  Two distinct surfaces. (1) The public Spec Scoring API at api.getelva.ai is
  deliberately unauthenticated — "no account and no key" — for GET /api/review/checks
  and POST /api/review; everything else in Elva's API (repos, catalog, collections,
  MCP, chat, testing) sits behind authentication inside the app. (2) The platform's
  own MCP resource at app.getelva.ai/mcp is OAuth 2.0-protected, discovered via
  RFC 8414 + RFC 9728 metadata (probed 2026-09-07): authorization_code + PKCE S256,
  dynamic client registration. Separately, Elva's hosted-MCP runtime RELAYS customer
  upstream auth (no_auth, api_key, bearer_token, jwt, basic_auth, oauth_2_0
  client-credentials/password, openid_connect) — a stateless in-memory token relay,
  documented for customer deployments, not an auth scheme of Elva's own API.
schemes:
  - name: none
    type: none
    surface: Spec Scoring API (api.getelva.ai)
    detail: GET /api/review/checks and POST /api/review are open to everyone, no key.
  - name: oauth2
    type: oauth2
    surface: Elva platform MCP (app.getelva.ai/mcp)
    flows:
      authorizationCode:
        authorizationUrl: https://app.getelva.ai/oauth/authorize
        tokenUrl: https://app.getelva.ai/oauth/token
    detail: >-
      PKCE S256 required; dynamic client registration at
      https://app.getelva.ai/oauth/register; token endpoint auth
      client_secret_post or none. No scopes_supported published in the metadata.