generated: '2026-08-04'
method: searched
source: openapi/madhive-api-openapi-original.yml, openapi/madhive-mcp-openapi-original.json
docs: https://developer.madhive.com/mcp
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - clientCredentials
  - authorizationCode
  token_format: JWT (RS256)
  gateway: Apigee
  scopes_published: false
onboarding:
  self_service: false
  note: >-
    Credentials are issued through a Madhive Account Manager. The developer portal exposes a
    Sign In and an API catalog, but the "my apps" self-service credential flow is deliberately
    disabled on the site (a portal script blocks /my-apps and hides the Apps dropdown), so a
    client_id/client_secret pair cannot be minted without a Madhive relationship.
endpoints:
  token: https://api2.madhive.com/oauth/token
  authorize: https://api2.madhive.com/oauth/authorize
  jwks: https://api2.madhive.com/.well-known/jwks.json
  discovery:
  - https://api2.madhive.com/.well-known/oauth-authorization-server
  - https://api2.madhive.com/.well-known/openid-configuration
  token_endpoint_auth_methods:
  - client_secret_post
  - client_secret_basic
  code_challenge_methods:
  - S256
  id_token_signing_alg:
  - RS256
schemes:
- name: oauth2
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://api2.madhive.com/oauth/token
    scopes: 0
  sources:
  - openapi/madhive-api-openapi-original.yml
  - openapi/madhive-mcp-openapi-original.json
- name: basicAuth
  type: http
  scheme: basic
  description: Basic Authentication Not Implemented
  implemented: false
  sources:
  - openapi/madhive-api-openapi-original.yml
  note: >-
    Declared in the spec but the provider's own description states it is not implemented.
    Treat it as spec residue, not an available auth method.
- name: bearerAuth
  type: apiKey
  in: header
  parameter: Authorization
  description: jwt access token for authentication
  sources:
  - openapi/madhive-api-openapi-original.yml
  note: >-
    Modelled as apiKey-in-header rather than http/bearer, but it carries the same JWT the
    oauth2 clientCredentials flow issues — it is the presentation of the OAuth token, not a
    separate static API key.
- name: authorizationCode
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api2.madhive.com/oauth/authorize
    tokenUrl: https://api2.madhive.com/oauth/token
    pkce: S256
    scopes: 0
  sources:
  - https://developer.madhive.com/mcp
  - https://api2.madhive.com/.well-known/oauth-authorization-server
  note: >-
    User-delegated flow for interactive MCP clients (Claude Code, Claude Desktop/Web,
    Gemini CLI, VS Code). Documented and advertised in discovery, but absent from both
    published OpenAPI documents. Custom redirect URIs must be registered with Madhive.
token_lifetime:
  expires_in: 1799
  unit: seconds
  source: https://developer.madhive.com/mcp
  note: value shown in the provider's own documented token response (~30 minutes)
observations:
- No OAuth scopes are published on any surface — see scopes/madhive-scopes.yml.
- The /.well-known/openid-configuration document advertises only client_credentials and
  response_types [token] with no authorization_endpoint, so it describes a token service
  rather than a full OpenID Provider.
- No mutualTLS, no signed requests, no proof-of-possession, no DPoP.
x-evidence:
- fetched: '2026-08-04'
  url: https://api2.madhive.com/.well-known/oauth-authorization-server
  http_status: 200
- fetched: '2026-08-04'
  url: https://api2.madhive.com/.well-known/openid-configuration
  http_status: 200
- fetched: '2026-08-04'
  url: https://api2.madhive.com/mcp
  http_status: 401
  note: 'anonymous MCP call rejected: "Missing or invalid Authorization header. Expected format: Bearer <token>"'