Summary
Security & Compliance covers how people and systems get into your Perform.AI account: portal login with a password or your company’s single sign-on, role-based access for your users, OAuth 2.0 client credentials for the Public API, HMAC-signed outgoing webhooks, and OAuth 2.1 sign-in for the MCP server. Each surface authenticates separately, and every one of them acts only on the account or organization it was issued for.Who it’s for
IT, security and compliance teams completing a supplier review, administrators deciding who gets which role, and developers who need to know how credentials and tokens work before they integrate.Key benefits
- Login follows your identity provider. Organizations can federate portal login to their own identity provider, which then enforces its own credential rules, including any multi-factor policy, and can switch password login off entirely.
- Passwords have rules and a lockout. Passwords must meet complexity rules, five failed attempts lock the account until a reset is completed, and the reset form is protected against bots.
- Roles limit what each user sees and does. Five roles cover administration, shipment creation, analytics, tracking experiences and customer service, and only Administrators manage users.
- API access is credential-based and short-lived. Each account has a Client ID and Client Secret; tokens last one hour and can be rotated without downtime.
- Your assistant sees exactly what you see. MCP sessions run as the signed-in user, scoped server-side to one organization and that user’s portal permissions, and every tool is read-only.
How it works
Portal login
The login page offers two paths, a Password tab and an SSO tab, and which tabs are available is an organization-level setting.
Password rules: at least 10 characters, with an uppercase letter, a lowercase letter, a digit and a special character, and no spaces. Five consecutive failed attempts lock the account, and the lock stays even if the correct password is entered afterwards, until a password reset is completed. The reset form is protected by reCAPTCHA. Perform.AI does not force periodic password changes.
Organizations with SSO can go SSO-only: password login is switched off, new users receive no password-creation email, and a user who signs in through SAML for the first time is created and assigned a role automatically. An SSO-only user cannot use the Password tab, because no password exists.
After either path, a signed session is issued that persists across browser restarts.
Roles
Only Administrators can open User Management and add, edit or remove users. Each user holds one of five roles.
User statuses are Inactive (never logged in), Active (has logged in) and Disabled (disabled when the subscription expired or was downgraded). Steps are on the User Management page.
Public API authentication
The Public API accepts HTTPS only and uses OAuth 2.0 Bearer tokens.Outgoing webhook authentication
Every webhook Perform.AI sends carries anHTTP-X-Hmac-SHA256 header: the HMAC-SHA256 of the raw request body, keyed with the Authentication Key shown under Integrations > Webhooks. Recompute it on your side and compare; a match proves the webhook came from Perform.AI. HMAC is the default. OAuth 2.0, JWT, Basic or a static key can be arranged through your account team. Allowlist Perform.AI by hostname rather than IP.
MCP sign-in
The Perform.AI MCP server athttps://mcp.perform.ai/mcp uses OAuth 2.1 with discovery and dynamic client registration. No API keys are involved: your client opens the Perform.AI sign-in page on first use, and you sign in with your Perform.AI username and password or with Sign in with Google.
- Who can connect. Anyone with a Perform.AI account in at least one organization. Each person signs in with their own account; teams share nothing but the server URL.
- Organization scoping. After sign-in you select which of your organizations the session acts on, and can switch at any time. No tool accepts an organization parameter; the organization is resolved server-side from the validated session. Identifiers from other organizations return not-found, and responses never confirm that another organization’s data exists.
- Data visibility. Exactly what you can see in the portal, nothing more. A user removed from an organization loses access through the MCP as well. Shipment details can include recipient names, addresses, emails and phone numbers when your portal permissions allow them; the default concise view omits most of these fields, and more detailed views return them.
- Read-only. No tool creates, updates or deletes anything. Changes are made in the portal.
- Redirect URIs. Third-party clients must register HTTPS redirect URIs; loopback URIs for desktop clients are always accepted. A client that redirects to a domain Perform.AI does not recognise shows a consent screen naming the destination. To allowlist your redirect domains, contact your account team.
- Data handling. Data goes only to the client you connected, over your authenticated session. How that provider handles it is governed by your agreement with that provider.
Certifications and data protection
Set up in the portal
Manage users and roles
- Go to Settings > Users.
- Select Add user, enter the email address and select Continue.
- Choose a role and select Add. To change a role or remove a user, select the user’s email address in the list.
Request API credentials
- Go to Integrations > API and select Request Credentials.
- Store the Client ID and Client Secret on your server.
- Generate a token with
POST /auth/oauth/token/and send it asAuthorization: Beareron every call.
Secure your webhook endpoint
- Go to Integrations > Webhooks and register your HTTPS endpoint.
- Copy the Authentication Key and use it to verify the
HTTP-X-Hmac-SHA256header on every request.
Configure SSO
Contact your account team.Use via API and MCP
- Guide: Authentication.
- API reference: Generate Bearer Access Token.
- MCP: Installation covers the sign-in flow per client; the MCP overview covers scoping and permissions.
FAQ
Does Perform.AI support single sign-on?
Yes. Login is configured per organization: password, SSO through Google, Microsoft Entra ID or a SAML-based provider, or both. An organization can also be SSO-only, with password login switched off.How do we meet a multi-factor authentication requirement?
Federate portal login to your own identity provider through SSO. Your identity provider then enforces its own credential rules, including its multi-factor policy, on every login.I entered the correct password and I am still locked out. Why?
After five failed attempts the account stays locked until a password reset is completed, even if the correct password is entered afterwards. Complete the reset.How long does an API token last, and what happens when it expires?
One hour. Expired tokens return HTTP 403Key not authorized. Request a new token before the hour is up; existing tokens stay valid, so you can rotate without downtime.