generated: '2026-08-09'
method: searched
source: openapi/rtcstats-api-openapi.yml
docs:
  - https://rtcstats.com/api-docs
  - https://rtcstats.com/integrations/mcp
  - https://rtcstats.com/llms.txt
description: >-
  One authentication mechanism across the whole surface: a static application
  JWT presented as an HTTP Bearer token. There is no OAuth 2.0 authorization
  server, no OIDC discovery, no API-key header variant and no mTLS — probes of
  /.well-known/oauth-authorization-server, /.well-known/oauth-protected-resource
  and /.well-known/openid-configuration return 404 on both hosts. The same token
  authenticates the REST API and the MCP Streamable HTTP endpoint.
summary:
  types:
    - http
  http_schemes:
    - bearer
  bearer_formats:
    - JWT
  api_key_in: []
  oauth2_flows: []
schemes:
  - name: BearerAuth
    type: http
    scheme: bearer
    bearerFormat: JWT
    description: 'Use header: Authorization: Bearer <token>'
    applied_to: all 9 operations (declared per-operation in the OpenAPI security block)
    sources:
      - openapi/rtcstats-api-openapi.yml
token_lifecycle:
  issuance: rtcStats dashboard, Settings > Applications — create an application to mint a token
  visibility: Shown once at creation and cannot be read back; if lost, create a new application
  rotation: Create a new application and retire the old one; no documented rotation endpoint or expiry policy
  scopes: none — the token is account-wide with no scope or permission model
  revocation: Delete the application in the dashboard
plan_gating:
  api_access: Developer plan or above; accounts without API access receive HTTP 403
  mcp_access: Developer plan or above
  free_plan: No API or MCP access
mcp:
  endpoint: https://api.rtcstats.com/v1.0/mcp
  header: 'Authorization: Bearer <application JWT>'
  anonymous_methods:
    - initialize
    - tools/list
  authenticated_methods:
    - tools/call
  note: >-
    Discovery is deliberately open — the tool contract with real inputSchema is
    readable without credentials; only tool invocation requires the token.
failure_modes:
  - {status: 401, meaning: Missing or invalid token}
  - {status: 403, meaning: API access is not included in the account plan}
gaps:
  - No OAuth 2.1 / dynamic client registration for the MCP server, which is where hosted MCP is converging.
  - No scopes — a token that can read every session can also delete every session.
  - No documented token expiry, so credential rotation is entirely manual.