generated: '2026-08-17'
method: probed
source: https://api.kleio.ai/.well-known/oauth-authorization-server
also_source: https://auth.kleio.ai/.well-known/openid-configuration
note: 'Derived from the two machine-readable discovery documents Kleio actually serves, not from an
  OpenAPI — Kleio publishes no specification and no public authentication documentation. The scripted
  derive (derive-authentication.py) found zero schemes because there is no spec in the repo to read; this
  profile is written from the probed RFC 8414 and OpenID Connect discovery documents saved verbatim under
  well-known/. Everything below is a value Kleio published; nothing is inferred about operation-level
  security, which is not observable without credentials.'
summary:
  types:
  - oauth2
  - openIdConnect
  oauth2_flows:
  - authorizationCode
  api_key_in: []
  pkce: required
  pkce_methods:
  - S256
  dynamic_client_registration: true
  identity_provider: Auth0 (EU tenant)
schemes:
- name: KleioPlatformOAuth
  type: oauth2
  source: https://api.kleio.ai/.well-known/oauth-authorization-server
  issuer: https://auth.kleio.ai/
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.kleio.ai/authorize
    tokenUrl: https://auth.kleio.ai/oauth/token
    audience: https://chwai-api-5sj2xluyjq-od.a.run.app
    note: 'The authorization_endpoint the gateway advertises carries a pinned audience query parameter
      naming the Cloud Run service behind the gateway. Recorded verbatim because it is the resource
      indicator a token must be minted for; it is not a separately documented API host.'
  grant_types:
  - authorization_code
  - refresh_token
  response_types:
  - code
  code_challenge_methods:
  - S256
  registration_endpoint: https://api.kleio.ai/api/oauth/register
  jwks_uri: https://auth.kleio.ai/.well-known/jwks.json
- name: KleioOIDC
  type: openIdConnect
  source: https://auth.kleio.ai/.well-known/openid-configuration
  openIdConnectUrl: https://auth.kleio.ai/.well-known/openid-configuration
  issuer: https://auth.kleio.ai/
  userinfo_endpoint: https://auth.kleio.ai/userinfo
  revocation_endpoint: https://auth.kleio.ai/oauth/revoke
  device_authorization_endpoint: https://auth.kleio.ai/oauth/device/code
  registration_endpoint: https://auth.kleio.ai/oidc/register
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  token_endpoint_auth_signing_algs:
  - RS256
  - RS384
  - PS256
  code_challenge_methods:
  - S256
  - plain
  response_modes:
  - query
  - fragment
  - form_post
  subject_types:
  - public
observations:
- 'Dynamic client registration is open on the gateway itself (api.kleio.ai/api/oauth/register returns 405
  to GET, confirming the route is defined and expects POST). Open DCR plus authorization-code with S256
  PKCE is the exact shape the MCP authorization specification prescribes, which is consistent with the
  MCP/UCP integration Kleio markets — but no MCP endpoint is published, so the pairing cannot be
  confirmed from outside.'
- 'The gateway rejects every undefined path with a Google Cloud API Gateway 404 ("The current request is
  not defined by this API"), so the route table is closed and cannot be enumerated anonymously.'
- 'No API-key scheme was observed anywhere. There is no public auth guide, quickstart, or token page.'
gaps:
- 'No published authentication documentation on kleio.ai — the only auth contract a developer can read is
  the discovery metadata captured here.'
- 'No /.well-known/oauth-protected-resource (RFC 9728) on api.kleio.ai, so resource-server metadata is
  not discoverable.'