generated: '2026-07-26'
method: searched
source: https://docs.mlsgrid.com/master.md
docs: https://docs.mlsgrid.com/master.md#authentication
note: >-
  No OpenAPI or OData $metadata document could be retrieved anonymously (every anonymous call to
  api.mlsgrid.com returns HTTP 401), so this profile is read from the public documentation rather
  than derived from a machine-readable contract.
summary:
  types:
  - http
  api_key_in: []
  oauth2_flows: []
  self_serve: false
schemes:
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: OAuth 2.0 access token (long-lived)
  in: header
  header: Authorization
  value_template: 'Bearer <access_token>'
  description: >-
    MLS Grid describes its scheme as "a simplified Oauth 2 authentication schema with long term
    tokens" — there is no token endpoint and no authorization-code round trip. Trust is established
    out of band through the subscription sign-up process; the token is generated inside the MLS Grid
    web application and pasted into the Authorization header.
  sources:
  - https://docs.mlsgrid.com/master.md
  - https://docs.mlsgrid.com/api-documentation/api-version-2.0.md
issuance:
  self_serve: false
  flow: >-
    1) Accept the MLS Grid Master Data License Agreement through the MLS Grid online licensing
    portal. 2) Have a data subscription created and a licensee added. 3) Be approved by the
    originating MLS. Only then is an API token generated and presented on the token tab when viewing
    a subscription in the MLS Grid web application.
  console: https://app.mlsgrid.com/
  license_agreement: https://www.mlsgrid.com/s/MLS-GRID-Data-License-Agreement.pdf
  rotation: >-
    Contact support@mlsgrid.com to have the token re-generated; regeneration invalidates the old
    token. No self-service rotation endpoint is documented.
  expiry: Long-lived; no documented TTL or refresh flow.
additional_requirements:
- requirement: gzip
  detail: >-
    Every request must send an Accept-Encoding header containing gzip. Without it the service
    returns HTTP 400 "COMPRESSION REQUIRED" before it evaluates authentication.
  source: https://docs.mlsgrid.com/api-documentation/api-version-2.0.md
- requirement: media-user-agent
  detail: >-
    Requests that download media from a MediaURL must send an HTTP User-Agent header whose value is
    the OAuth 2 access token itself. From 2026-06-01 any other User-Agent is denied media access.
  source: https://docs.mlsgrid.com/releases/changes-to-mls-grid-media-access.md
scopes:
  documented: false
  note: >-
    No OAuth scope surface is published. Authorization is expressed per record in the payload
    (MlgCanUse use-case array and the MlgCanView license flag) and per subscription (feed type:
    IDX / VOW / BO / PT), not as token scopes.
discovery:
  probed:
  - url: https://api.mlsgrid.com/.well-known/openid-configuration
    status: 401
  - url: https://app.mlsgrid.com/.well-known/openid-configuration
    status: 200
    note: Returns the web application's HTML SPA shell, not an OIDC discovery document.
  - url: https://app.mlsgrid.com/.well-known/oauth-authorization-server
    status: 200
    note: Returns the web application's HTML SPA shell, not an RFC 8414 metadata document.
  - url: https://www.mlsgrid.com/.well-known/openid-configuration
    status: 404
  openid_connect: false
  rfc8414: false
  probed_on: '2026-07-26'