generated: '2026-08-27'
method: searched
source: openapi/*.yaml securitySchemes, enriched from https://redocly.com/docs/realm/reunite/organization/api-keys
  and https://redocly.com/docs/realm/customization/mcp-server (fetched 2026-08-27)
summary:
  types:
  - apiKey
  - http
  - oauth2
  api_key_in:
  - cookie
  - header
  oauth2_flows:
  - authorizationCode
schemes:
- name: OAuth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://{projectHost}/_mcp/oauth2/auth
    tokenUrl: https://{projectHost}/_mcp/oauth2/token-portal
    scopes: 0
  sources:
  - openapi/redocly-docs-mcp-openapi.yaml
- name: GithubApiKey
  type: apiKey
  in: header
  parameter: x-hub-signature-256
  sources:
  - openapi/redocly-scout-agent-openapi.yaml
- name: GitlabApiKey
  type: apiKey
  in: header
  parameter: x-gitlab-token
  sources:
  - openapi/redocly-scout-agent-openapi.yaml
- name: UserCookie
  type: apiKey
  in: cookie
  parameter: accessToken
  description: Default authentication scheme for interaction between browser and API.
  sources:
  - openapi/redocly-scout-openapi.yaml
- name: ApiKey
  type: http
  scheme: bearer
  description: 'API key is required to access the API.

    You can get your API key from the [BlueHarvest dashboard](https://app.blueharvest.cloud).'
  sources:
  - openapi/redocly-scout-openapi.yaml
docs: https://redocly.com/docs/realm/reunite/organization/api-keys
provider: Redocly
providerId: redocly
description: Redocly authenticates on three different planes. Reunite/Realm organizations issue long-lived
  API keys used against the Redocly platform API and the Scout tool; the Docs MCP server on a Realm project
  uses OAuth 2.0 authorization code against per-project endpoints and validates the token's aud claim
  against the organization ID; and the Scout worker authenticates inbound GitHub/GitLab webhooks by signature
  header. Redocly's own docs project is public, so its Search API and Docs MCP server accept anonymous
  requests.
api_keys:
  docs: https://redocly.com/docs/realm/reunite/organization/api-keys
  storage: Redocly stores API keys as one-way cryptographic hashes; the plaintext value cannot be retrieved
    after creation.
  expiration: Optional expiration date in UTC; a key with no expiry stays valid until manually revoked.
  ip_restriction: Keys can be restricted to one or more allowed IP addresses on plans that include IP
    restrictions.
  permission_models:
  - name: Granular permissions
    description: Individually selected organization and project permissions; at least one must be selected.
      Permission types are read, write and delete.
  - name: RBAC
    description: The key is assigned to one or more teams and inherits their roles, following the same
      RBAC logic as users.
  - name: Legacy full access
    description: Read-only model shown for older unrestricted keys. New keys cannot use it; saving a legacy
      key requires converting it to Granular or RBAC.
  used_for:
  - Redocly platform API
  - Redocly Scout
oauth:
  docs: https://redocly.com/docs/realm/customization/mcp-server
  flow: authorization_code
  authorization_url: https://{projectHost}/_mcp/oauth2/auth
  token_url: https://{projectHost}/_mcp/oauth2/token-portal
  audience_validation: The Docs MCP server compares the bearer token's aud claim to the organization ID.
    Off by default; REDOCLY_MCP_ENFORCE_TOKEN_AUDIENCE=true rejects mismatches with 401. Tokens with no
    aud claim skip the check.
  dynamic_client_registration: Realm/Reef advertise dynamic client registration and Client ID Metadata
    Document (CIMD) support for developer onboarding.
sso:
  docs: https://redocly.com/security
  methods:
  - SAML 2.0
  - OpenID Connect
  note: Enterprise SSO with domain verification, team mapping from IdP attributes, and project-level roles
    and permissions.
anonymous_surfaces:
- surface: https://redocly.com/mcp
  note: Docs MCP server; anonymous tools/list returned 200 on 2026-08-27 because redocly.com is a public
    project.
- surface: POST /_search on a public Realm project
  note: The Search API needs no auth on public projects; protected projects use the browser session cookie
    only — it accepts no API key or bearer token.
notes:
- The ApiKey scheme in openapi/redocly-scout-openapi.yaml carries a legacy description pointing at app.blueharvest.cloud.
  Title, contact (team@redocly.com), termsOfService and the docs location all name Redocly; the BlueHarvest
  string is a stale reference inside one scheme description, not a different owner.