Botify · OAuth Scopes

Botify OAuth Scopes

OAuth 2.0 probed

Botify uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

seoorganic-searchsearch-engine-optimizationweb-crawlinglog-analysissearch-consolemarketing-analyticsai-searchdata-exportmcpagent-native

Scopes: 0 Flows: Method: probed

Scopes (0)

Botify implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

Botify's OAuth surface exists only for its MCP server. The REST API at api.botify.com/v1 is not OAuth-based — it uses a single per-user API token in the Authorization header with no scope concept at all (see authentication/botify-authentication.yml). The authorization server at app.botify.com advertises exactly one scope, and it is coarse: a single read-write grant over the whole MCP surface. There is no read-only variant, no per-product (SiteCrawler / LogAnalyzer / RealKeywords) split, and no per-project scoping in the published metadata.

📄 Provider scope reference: https://developers.botify.com/docs/getting-started

Source

OAuth Scopes

generated: '2026-08-08'
method: probed
source: https://app.botify.com/.well-known/oauth-authorization-server
docs: https://developers.botify.com/docs/getting-started
note: >-
  Botify's OAuth surface exists only for its MCP server. The REST API at api.botify.com/v1 is not OAuth-based —
  it uses a single per-user API token in the Authorization header with no scope concept at all
  (see authentication/botify-authentication.yml). The authorization server at app.botify.com advertises exactly
  one scope, and it is coarse: a single read-write grant over the whole MCP surface. There is no read-only
  variant, no per-product (SiteCrawler / LogAnalyzer / RealKeywords) split, and no per-project scoping in the
  published metadata.
authorization_server: https://app.botify.com/
protected_resources:
- resource: https://mcp.botify.com/
  resource_name: Botify Agents MCP
  scopes_supported:
  - mcp_read_write
scopes:
- name: mcp_read_write
  description: >-
    The only scope advertised by the Botify authorization server. Granted to an MCP client after the
    authorization-code + PKCE flow; combined read and write access to the Botify Agents MCP surface.
    Botify publishes no further description of what it covers.
  read_only: false
  source: https://app.botify.com/.well-known/oauth-authorization-server
flows:
  authorization_code:
    authorization_endpoint: https://app.botify.com/oauth/authorize
    token_endpoint: https://app.botify.com/oauth/token/
    pkce_methods:
    - S256
  refresh_token: true
endpoints:
  registration: https://app.botify.com/oauth/register/
  revocation: https://app.botify.com/oauth/revoke/
  introspection: https://app.botify.com/oauth/introspect/
token_endpoint_auth_methods_supported:
- client_secret_basic
- client_secret_post
- none
x-evidence:
  fetched: '2026-08-08'
  probes:
  - url: https://app.botify.com/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json
  - url: https://mcp.botify.com/.well-known/oauth-protected-resource
    http_status: 200
    content_type: application/json