Cello · OAuth Scopes

Cello OAuth Scopes

OAuth 2.0 probed

Cello uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyReferral MarketingAffiliate MarketingGrowthSaaSAttributionPartner ProgramsAi Enterprise Software

Scopes: 0 Flows: Method: probed

Scopes (0)

Cello implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference: https://docs.cello.so/mcp/introduction

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://mcp.cello.so/.well-known/oauth-protected-resource
docs: https://docs.cello.so/mcp/introduction
summary: >-
  Cello's OAuth surface belongs to the hosted MCP server, not to the REST API. The MCP server
  publishes RFC 9728 protected-resource metadata declaring two resource scopes, mcp:read and
  mcp:write, and names https://auth.cello.so as its authorization server. The REST API at
  api.cello.so declares no oauth2 securityScheme and no scopes at all — it authenticates with an
  accessKeyId/secretAccessKey exchange at POST /token that returns an opaque bearer accessToken,
  which carries no scope claim in any documented response.
resource:
  identifier: https://mcp.cello.so
  authorization_servers:
  - https://auth.cello.so
  bearer_methods_supported:
  - header
scopes:
- name: mcp:read
  source: https://mcp.cello.so/.well-known/oauth-protected-resource
  description: >-
    Read access to the Cello MCP server. Cello's own tool reference states that all MCP tools are
    currently read-only, so this is the scope every published tool needs — program metrics,
    referrers, top referrers, integration status, events, recommendations, knowledge-base search,
    and the docs filesystem query.
  applies_to_tools:
  - cello_get_program_metrics
  - cello_get_referrers
  - cello_get_top_referrers
  - cello_get_integration_status
  - cello_get_events
  - cello_get_recommendations
  - search_cello
  - query_docs_filesystem_cello
  evidence: https://docs.cello.so/mcp/tools
- name: mcp:write
  source: https://mcp.cello.so/.well-known/oauth-protected-resource
  description: >-
    Write access to the Cello MCP server. Advertised in the protected-resource metadata but not
    exercised by any tool Cello currently documents; the tool reference says the assistant points
    you to the Cello Portal to make changes. Recorded as declared-but-unused.
  applies_to_tools: []
  status: declared-unused
authorization_server:
  issuer: https://auth.cello.so
  metadata: ../well-known/cello-oauth-authorization-server.json
  authorization_endpoint: https://auth.cello.so/oauth2/auth
  token_endpoint: https://auth.cello.so/oauth2/token
  registration_endpoint: https://auth.cello.so/oauth2/register
  revocation_endpoint: https://auth.cello.so/oauth2/revoke
  jwks_uri: https://auth.cello.so/.well-known/jwks.json
  grant_types_supported:
  - authorization_code
  - implicit
  - client_credentials
  - refresh_token
  - urn:ietf:params:oauth:grant-type:device_code
  code_challenge_methods_supported:
  - plain
  - S256
  scopes_supported:
  - offline_access
  - offline
  - openid
  note: >-
    The authorization server advertises only the three OIDC/offline scopes in scopes_supported;
    the mcp:read and mcp:write resource scopes appear solely in the MCP protected-resource
    document. A client requesting them relies on the resource indicator, not on the AS metadata.
rest_api:
  oauth2: false
  note: >-
    No oauth2 securityScheme in openapi/_original/cello-openapi-original.json — the only scheme is
    bearerAuth (type http, scheme bearer). derive-oauth-scopes.py reports 0 oauth2 schemes for
    this provider; nothing here was derived from the spec.
x-evidence:
  fetched: '2026-08-13'
  probes:
  - {url: 'https://mcp.cello.so/.well-known/oauth-protected-resource', http_status: 200}
  - {url: 'https://auth.cello.so/.well-known/oauth-authorization-server', http_status: 200}
  - {url: 'https://auth.cello.so/.well-known/openid-configuration', http_status: 200}
  - {url: 'https://mcp.cello.so/mcp', http_status: 401, note: 'POST tools/list returned WWW-Authenticate: Bearer resource_metadata=...'}