Adobe Launch · OAuth Scopes

Adobe Launch OAuth Scopes

OAuth 2.0 searched

Adobe Launch uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Data CollectionEdge NetworkEvent ForwardingMarketing TechnologyTag Management
Scopes: 0 Flows: Method: searched

Scopes (0)

Adobe Launch implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference: https://developer.adobe.com/developer-console/docs/guides/authentication/ServerToServerAuthentication/

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-13'
method: searched
source: >-
  https://experienceleague.adobe.com/en/docs/experience-platform/tags/api/getting-started
  · https://developer.adobe.com/developer-console/docs/guides/authentication/ServerToServerAuthentication/
provider: Adobe Launch
providerId: adobe-launch
docs: https://developer.adobe.com/developer-console/docs/guides/authentication/ServerToServerAuthentication/
flow: client_credentials
token_endpoint: https://ims-na1.adobelogin.com/ims/token/v3
token_lifetime: 24 hours
notes: >-
  Adobe Launch inherits Adobe IMS scopes rather than defining its own. Neither
  Adobe's published Reactor OpenAPI nor the Edge Network contract declares an
  `oauth2` securityScheme with a scopes map — the Reactor contract declares no
  securitySchemes at all and states the header requirements in prose — so
  `derive-oauth-scopes.py` correctly found nothing to derive. The scopes below
  are the IMS scopes Adobe Developer Console attaches to an OAuth
  Server-to-Server credential; the exact string is copied verbatim from the
  credential screen for the project rather than composed by the developer.
  Authorization for a given property is NOT expressed as a scope: it is
  resolved from the IMS organization in x-gw-ims-org-id and the product profile
  the technical account belongs to.
scheme_declared_in_spec: false
scope_count: 5
scopes:
  - name: openid
    description: OpenID Connect base scope; issues an ID token alongside the access token.
    required: true
  - name: AdobeID
    description: Core Adobe identity scope required by every Adobe IMS credential.
    required: true
  - name: read_organizations
    description: Read the organizations the technical account belongs to; resolves the IMS Org ID sent in x-gw-ims-org-id.
    required: true
  - name: additional_info.projectedProductContext
    description: >-
      Returns the product entitlements attached to the technical account. This
      is what actually decides whether the credential can reach Experience
      Platform Tags and which properties it may act on.
    required: true
  - name: additional_info.roles
    description: Returns the roles assigned to the technical account. Commonly present on Experience Platform credentials.
    required: false
authorization_model:
  style: entitlement + product profile, not per-scope
  note: >-
    Reactor authorization is enforced by the Admin Console product profile
    ("Tags" / "Data Collection" rights: platform read, develop, approve,
    publish, manage extensions, manage environments) applied to the IMS
    organization named in x-gw-ims-org-id. Those rights are not exposed as
    OAuth scopes and cannot be requested at token time.
  rights_reference: https://experienceleague.adobe.com/en/docs/experience-platform/tags/admin/user-permissions
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com