generated: '2026-08-14'
method: searched
source: https://support.revenue.io/guided-selling/salesforce-administration/installation-and-setup/setup-api-credentials/
docs: https://support.revenue.io/integrations/salesforce/common-salesforce-errors/oauth-access-scope/
name: RingDNA / Revenue.io Authentication
description: >-
  Revenue.io has no single API gateway and therefore no single authentication
  model. There are three distinct, documented or probed authentication surfaces,
  and they do not share credentials. This profile was assembled from the
  Revenue.io Knowledge Center and from live probes of the MCP discovery
  documents - there is no OpenAPI in this repo to derive securitySchemes from.

summary:
  types:
    - oauth2
    - apiKey
  api_key_in:
    - application-config
  oauth2_flows:
    - authorizationCode
  surfaces: 3
  openapi_derived: false
  note: >-
    api_key_in is "application-config" rather than header/query because the
    Guided Selling API Key and Secret are entered into a Salesforce settings
    screen, not attached to a request the customer composes.

schemes:
  - name: mcp-oauth
    surface: MCP server (https://app.ringdna.com/mcp)
    type: oauth2
    method: probed
    source: https://app.ringdna.com/.well-known/oauth-authorization-server
    flows:
      - flow: authorizationCode
        issuer: https://app.ringdna.com
        authorizationUrl: https://app.ringdna.com/mcp/oauth/authorize
        tokenUrl: https://app.ringdna.com/mcp/oauth/token
        registrationUrl: https://app.ringdna.com/mcp/oauth/register
        pkce: required
        code_challenge_methods:
          - S256
        refresh_token: true
        scopes:
          mcp: Access the RingDNA MCP server.
    token_presentation: Authorization Bearer header
    dynamic_client_registration: true
    client_authentication: none
    notes:
      - The only machine-negotiable authentication Revenue.io publishes.
      - Anonymous dynamic client registration returns 201, so an agent can self-register.
      - Undocumented in the Knowledge Center; discovered by well-known probe.

  - name: guided-selling-api-credentials
    surface: Guided Selling managed package (RDNACadence) to Revenue.io servers
    type: apiKey
    method: searched
    source: https://support.revenue.io/guided-selling/salesforce-administration/installation-and-setup/setup-api-credentials/
    credentials:
      - API Key
      - API Secret
    provisioning: >-
      Not self-service. Credentials are generated by the customer's Revenue.io
      Implementation Manager or the Support team and handed over out of band.
    binding: >-
      The API Key and API Secret are bound to the customer's Salesforce
      Organization ID. Refreshing a partial-copy Salesforce sandbox can change the
      Org ID, which invalidates the credentials until Revenue.io Support updates
      the Org ID on the account.
    entry_point: >-
      Salesforce App Launcher > Guided Selling by Revenue.io > Settings > Setup;
      paste API Key and API Secret and Save.
    validation: >-
      Acceptance is confirmed by a message on the Setup page and by the Users tab
      populating with every user holding a Guided Selling license.
    scopes_documented: false
    notes:
      - >-
        This is a sales/support-gated credential. There is no developer portal,
        no key self-service, and no published key rotation policy.
      - >-
        Valid credentials gate nearly all Guided Selling functionality including
        sending emails, executing template actions, and permission confirmation.

  - name: salesforce-connected-app-oauth
    surface: RingDNA Communications Hub / Revenue.io platform to the customer Salesforce org
    type: oauth2
    method: searched
    source: https://support.revenue.io/integrations/salesforce/common-salesforce-errors/oauth-access-scope/
    flows:
      - flow: authorizationCode
        authorizationUrl: https://login.salesforce.com/services/oauth2/authorize
        refresh_token: true
        scopes:
          api: >-
            Access the current logged-in user's account using APIs such as REST
            API and Bulk API 2.0. Includes chatter_api for Connect REST API.
          web: >-
            Use the access_token on the web. Includes visualforce for
            customer-created Visualforce pages.
          refresh_token: >-
            Return a refresh token so the application can interact with the
            user's data while the user is offline (equivalent to offline_access).
    identity_provider: Salesforce
    revocation: >-
      Users and administrators can revoke Revenue.io's access at any time from
      Salesforce.
    prerequisites:
      - >-
        The Salesforce user profile must have "API Enabled" checked, or login
        fails with [API_CURRENTLY_DISABLED].
      - Salesforce SSO is supported for dialer sign-in.
    notes:
      - >-
        Revenue.io is registered as a Salesforce OAuth Connected App; this is the
        authentication that actually carries production traffic.
      - >-
        Because all data flows through the customer's Salesforce org, the
        effective authorization model is Salesforce profiles and permission sets,
        not a Revenue.io scope system.

not_found:
  - >-
    No OpenID Connect discovery document on any host
    (/.well-known/openid-configuration is 404 on app.ringdna.com,
    api.revenue.io, www.revenue.io).
  - >-
    No public API key self-service, no developer portal, no token endpoint for a
    general-purpose REST API. api.ringdna.com - the baseURL published in
    apis.yml - is NXDOMAIN.
  - No mutualTLS, no HTTP basic, no documented signed-request scheme.