0xArchive · OAuth Scopes

0xArchive OAuth Scopes

OAuth 2.0 searched

0xArchive uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

market datahistorical datacryptoDeFiperpetualsderivativesorder bookHyperliquidLighterHIP-3HIP-4prediction marketsWebSocketstreaminghistorical replayParquetbulk dataMCPagent-nativex402OpenAPIREST
Scopes: 0 Flows: Method: searched

Scopes (0)

0xArchive implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

These scopes govern the hosted MCP surface ONLY, not the REST API. The REST API uses an X-API-Key header with no scope model at all - 0-working/derive-oauth-scopes.py correctly found zero oauth2 securitySchemes in the OpenAPI, because there are none. The scopes below are read from the provider's live RFC 8414 authorization-server metadata, which is why this file is method: searched rather than derived. Two facts about this list are worth reading together. First, the authorization server advertises SIX scopes covering market data, account bootstrap and creation, key read and revoke, and billing subscription - a full self-serve account-lifecycle scope set. Second, the MCP resource itself advertises exactly ONE of them: scopes_supported is ["mcp:market.read"] in the protected-resource metadata, and both the docs and llms.txt state twice that "the server advertises mcp:market.read only". So an agent connecting to the hosted MCP today gets read-only market data and nothing else; the remaining five scopes exist at the authorization server but are not reachable through the MCP resource. That is a deliberately narrow blast radius for an autonomous client, and it should be described as such rather than as five missing capabilities.

📄 Provider scope reference: https://docs.0xarchive.io/mcp-server

Source

OAuth Scopes

Raw ↑ 
generated: '2026-09-01'
method: searched
source: https://api.0xarchive.io/.well-known/oauth-authorization-server
docs: https://docs.0xarchive.io/mcp-server
sources:
- https://api.0xarchive.io/.well-known/oauth-authorization-server
- https://mcp.0xarchive.io/.well-known/oauth-protected-resource
- https://docs.0xarchive.io/mcp-server
- https://0xarchive.io/llms.txt
note: >-
  These scopes govern the hosted MCP surface ONLY, not the REST API. The REST API uses an
  X-API-Key header with no scope model at all - 0-working/derive-oauth-scopes.py correctly found
  zero oauth2 securitySchemes in the OpenAPI, because there are none. The scopes below are read
  from the provider's live RFC 8414 authorization-server metadata, which is why this file is
  method: searched rather than derived.
  Two facts about this list are worth reading together. First, the authorization server advertises
  SIX scopes covering market data, account bootstrap and creation, key read and revoke, and
  billing subscription - a full self-serve account-lifecycle scope set. Second, the MCP resource
  itself advertises exactly ONE of them: scopes_supported is ["mcp:market.read"] in the
  protected-resource metadata, and both the docs and llms.txt state twice that "the server
  advertises mcp:market.read only". So an agent connecting to the hosted MCP today gets read-only
  market data and nothing else; the remaining five scopes exist at the authorization server but
  are not reachable through the MCP resource. That is a deliberately narrow blast radius for an
  autonomous client, and it should be described as such rather than as five missing capabilities.
issuer: https://auth.0xarchive.io
authorization_endpoint: https://auth.0xarchive.io/oauth/authorize
token_endpoint: https://auth.0xarchive.io/oauth/token
revocation_endpoint: https://auth.0xarchive.io/oauth/revoke
registration_endpoint: https://auth.0xarchive.io/oauth/register
jwks_uri: https://auth.0xarchive.io/.well-known/jwks.json
grant_types:
- authorization_code
- refresh_token
response_types:
- code
pkce:
  required_methods:
  - S256
token_endpoint_auth_methods:
- none
dynamic_client_registration: true
resource: https://mcp.0xarchive.io/mcp
resource_scopes_supported:
- mcp:market.read
scopes:
- name: mcp:market.read
  description: >-
    Read market data through the hosted MCP server - instruments, order books (L2/L3/L4), trades,
    candles, funding, open interest, liquidations, outcome markets, spot and data-quality routes.
  reachable_via_mcp: true
  grants: read
- name: mcp:account.bootstrap
  description: Bootstrap an account for a caller that does not yet have one.
  reachable_via_mcp: false
  grants: write
- name: mcp:account.create
  description: Create a 0xArchive account.
  reachable_via_mcp: false
  grants: write
- name: mcp:keys.read
  description: List the API keys on the account.
  reachable_via_mcp: false
  grants: read
- name: mcp:keys.revoke
  description: Revoke an API key. Irreversible - see the reversibility block in conventions/.
  reachable_via_mcp: false
  grants: write
- name: mcp:billing.subscribe
  description: Start a paid subscription. Spends money - see the reversibility block in conventions/.
  reachable_via_mcp: false
  grants: write
service_documentation: https://0xarchive.io/docs/mcp
extras:
  authorization_response_iss_parameter_supported: true
  note: RFC 9207 issuer identification is enabled, which defends against mix-up attacks on a multi-AS client.

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this
  • find_scopesBrowse and filter every scope set in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This scope set 
curl "https://apis.io/api/v1/scopes/0xarchive-scopes"
All oauth scopes 
curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.