Algolia · OAuth Scopes

Algolia OAuth Scopes

OAuth 2.0 probed

Algolia uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

SearchDiscoveryRecommendationsPersonalizationAnalyticsE-Commerce
Scopes: 0 Flows: Method: probed

Scopes (0)

Algolia implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference:

Source

OAuth Scopes

Raw ↑ 
specification: API Commons OAuth Scopes
specificationVersion: '0.1'
provider: Algolia
providerId: algolia
generated: '2026-08-27'
method: probed
source: https://mcp.algolia.com/.well-known/oauth-protected-resource
sources:
  - https://mcp.algolia.com/.well-known/oauth-protected-resource
  - https://mcp.algolia.com/.well-known/oauth-authorization-server
  - https://www.algolia.com/doc/guides/model-context-protocol/productivity-mcp
  - https://www.algolia.com/doc/guides/security/api-keys/in-depth/api-key-restrictions
description: >-
  Algolia's REST APIs do NOT use OAuth - all 15 first-party OpenAPI documents declare apiKey-in-header
  (x-algolia-application-id + x-algolia-api-key) or, for the Crawler, HTTP Basic. Running
  derive-oauth-scopes.py over openapi/ finds zero oauth2 securitySchemes, correctly.
  OAuth exists in exactly one place in the estate: the Algolia Productivity MCP server. Its scope set was read
  from the RFC 9728 protected-resource metadata document, not inferred.
rest_oauth: false
rest_auth_model: api-key-with-acl
oauth_surfaces:
  - name: Algolia Productivity MCP
    resource: https://mcp.algolia.com/mcp
    issuer: https://dashboard.algolia.com
    authorization_endpoint: https://dashboard.algolia.com/2/oauth/authorize
    token_endpoint: https://dashboard.algolia.com/2/oauth/token
    registration_endpoint: https://dashboard.algolia.com/2/oauth/register
    introspection_endpoint: https://dashboard.algolia.com/2/oauth/introspect
    revocation_endpoint: https://dashboard.algolia.com/2/oauth/token
    grant_types: [authorization_code, refresh_token]
    response_types: [code]
    pkce_methods: [S256]
    client_auth_methods: [none]
    dynamic_registration: true
    scopes:
      - name: public
        description: >-
          The only scope Algolia advertises for the MCP resource. It is coarse by design: authorization is NOT
          carried by the scope but by the signed-in user's own Algolia permissions, which decide which applications
          and indices the agent can reach. A single scope string therefore expands to a different effective
          permission set per user.
        source: 'scopes_supported in https://mcp.algolia.com/.well-known/oauth-protected-resource'
    probe:
      url: https://mcp.algolia.com/mcp
      http_status: 401
      www_authenticate: 'Bearer resource_metadata="https://mcp.algolia.com/.well-known/oauth-protected-resource", scope="public"'
effective_authorization_model:
  note: >-
    Where a scope string would normally sit, Algolia puts an ACL on the API key. This is the real permission
    vocabulary for the REST surface and every operation reference names the ACL it requires.
  mechanism: api-key-acl
  docs: https://www.algolia.com/doc/guides/security/api-keys/in-depth/api-key-restrictions
  acls:
    - search
    - browse
    - addObject
    - deleteObject
    - deleteIndex
    - settings
    - editSettings
    - analytics
    - recommendation
    - usage
    - logs
    - seeUnretrievableAttributes
    - listIndexes
  acl_source: >-
    Enumerated from the ACL values documented on the API key restrictions page and used across the Search API
    operation reference. Not read from a machine-readable enum - Algolia does not publish the ACL list as one.
  restrictions:
    - validUntil (expiry)
    - restrictIndices
    - restrictSources (IP)
    - referers
    - maxQueriesPerIPPerHour
    - maxHitsPerQuery
  secured_api_keys:
    note: >-
      A search-only key can be signed client-side with embedded filters to produce a per-end-user key, which is
      Algolia's answer to per-tenant authorization without an authorization server.
    docs: https://www.algolia.com/doc/guides/security/api-keys/how-to/user-restricted-access-to-data
  limit: 5,000 API keys per application (documented service limit).

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this
  • find_scopesBrowse and filter every scope set in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This scope set 
curl "https://apis.io/api/v1/scopes/algolia-scopes"
All oauth scopes 
curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.