generated: '2026-07-22'
method: searched
source: https://kfinance.kensho.com/.well-known/oauth-authorization-server (RFC 8414) + https://kfinance.kensho.com/.well-known/oauth-protected-resource (RFC 9728)
docs: https://docs.kensho.com/authentication
notes: >-
  The published OpenAPI specs declare only a bearer JWT scheme (no oauth2 flows), so no scopes are
  derivable from spec. The live RFC 8414 authorization-server metadata on kfinance.kensho.com —
  the OAuth front door for the hosted kFinance MCP server — publishes the real scope surface.
  Kensho auth is OIDC on OAuth 2.0 with keypair (production) or refresh-token (development,
   7-day expiry) grants.
schemes:
  - name: Kensho OAuth 2.0 / OIDC (kFinance integrations)
    issuer: https://kfinance.kensho.com/integrations
    flows:
      - flow: authorizationCode
        authorizationUrl: https://kfinance.kensho.com/integrations/authorize
        tokenUrl: https://kfinance.kensho.com/integrations/token
        pkce: S256
      - flow: refresh_token
    registration: https://kfinance.kensho.com/integrations/register
    token_endpoint_auth_methods: [client_secret_post, client_secret_basic]
scopes:
  - scope: 'kensho:app:kfinance'
    description: Access to the kFinance (S&P Global LLM-Ready API) application, including the hosted MCP resource.
    flows: [authorizationCode]
    sources: [well-known/sp-global-oauth-authorization-server.json]
  - scope: offline_access
    description: Issue a refresh token for long-lived / unattended access.
    flows: [authorizationCode]
    sources: [well-known/sp-global-oauth-authorization-server.json]