Cerebelly · OAuth Scopes

Cerebelly OAuth Scopes

OAuth 2.0 searched

Cerebelly uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyBaby FoodConsumer Packaged GoodsFood and BeverageeCommerceRetailDirect to ConsumerShopifyAgentic CommerceUniversal Commerce ProtocolNutrition

Scopes: 0 Flows: Method: searched

Scopes (0)

Cerebelly implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-09'
method: searched
source: https://cerebelly.com/.well-known/openid-configuration
name: Cerebelly OAuth scopes
description: >-
  The complete scopes_supported list published by Cerebelly's own OpenID Connect
  discovery document. Four scopes, no more — this is the whole authorization
  vocabulary the domain exposes. Cerebelly publishes no OpenAPI, so this was read
  directly from the live metadata document rather than derived from a spec.
authorization_server: https://shopify.com/authentication/74590912725
authorization_endpoint: https://account.cerebelly.com/authentication/oauth/authorize
token_endpoint: https://account.cerebelly.com/authentication/oauth/token
flow: authorization_code
pkce: S256
granularity: coarse
scopes:
- name: openid
  description: >-
    Standard OpenID Connect scope. Requests an ID token identifying the customer;
    issues the sub, iss, aud, exp, iat, nonce and sid claims.
  standard: true
  spec: https://openid.net/specs/openid-connect-core-1_0.html
- name: email
  description: >-
    Standard OpenID Connect scope. Adds the email and email_verified claims to the
    ID token.
  standard: true
  spec: https://openid.net/specs/openid-connect-core-1_0.html
- name: 'customer-account-api:full'
  description: >-
    Full read and write access to the authenticated customer's account through the
    Customer Account GraphQL API at account.cerebelly.com — profile, addresses,
    orders, subscriptions and payment methods.
  standard: false
  granularity: all-or-nothing
  note: >-
    There is no read-only variant and no per-resource split. A customer consenting
    to this scope consents to the entire account surface at once.
- name: 'customer-account-mcp-api:full'
  description: >-
    Full access to the customer-account MCP API — the authenticated, per-customer
    counterpart to the anonymous UCP commerce MCP endpoint on the storefront host.
  standard: false
  granularity: all-or-nothing
  note: >-
    Notable as a first-class agent scope: the authorization server treats MCP as a
    distinct protected surface with its own consent grant, rather than folding it
    into the general account scope.
coverage:
  total: 4
  standard: 2
  provider_specific: 2
  read_only_variants: 0
observations:
- >-
  Both provider-specific scopes end in ":full". Neither offers least-privilege
  narrowing, so an agent that needs only order history must ask for write access to
  the entire account.
- >-
  No scope governs the anonymous commerce surfaces. search_catalog, create_cart and
  the Storefront GraphQL catalog fields require no grant at all.
x-evidence:
  fetched: '2026-08-09'
  url: https://cerebelly.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json; charset=utf-8