Cloud9 · OAuth Scopes

Cloud9 OAuth Scopes

OAuth 2.0 probed

Cloud9 publishes 1 OAuth 2.0 scope via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Cloud9 API on a user’s behalf.

Tokens are issued from https://cloud9.gg/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyEsportsGamingEntertainmentMediaSportsContentWordPressCommunityMerchandise

Scopes: 1 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://cloud9.gg/oauth/authorize

Token URL
https://cloud9.gg/oauth/token

Flows
authorizationCode

Scopes (1)

Scope	Description	Flows
mcp	Access the Cloud9 MCP server at https://cloud9.gg/wp-json/mcp/mcp-oauth-server. Coarse, single-scope model — the authorization server advertises no finer-grained read/write split, so a token that can read content can also invoke any write ability the adapter registered.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-09'
method: probed
source: https://cloud9.gg/.well-known/oauth-authorization-server
docs: null
description: >-
  Cloud9's only OAuth surface is the authorization server advertised on cloud9.gg for its remote
  MCP server. It declares a single coarse scope, `mcp`. Cloud9 publishes no developer program, no
  scope or permission reference, and no OpenID Connect discovery document on any host
  (/.well-known/openid-configuration returns 404). The anonymous WordPress REST API has no OAuth
  surface at all — reads need no credential and writes use WordPress application passwords.
schemes:
- name: Cloud9MCPOAuth
  type: oauth2
  source: https://cloud9.gg/.well-known/oauth-authorization-server
  issuer: https://cloud9.gg
  flows:
  - flow: authorizationCode
    authorizationUrl: https://cloud9.gg/oauth/authorize
    tokenUrl: https://cloud9.gg/oauth/token
    revocationUrl: https://cloud9.gg/oauth/revoke
    pkce: required
    code_challenge_methods: [S256]
    refresh_tokens: true
    client_authentication: none (public client)
    dynamic_client_registration: >-
      No RFC 7591 registration_endpoint is advertised. The server sets
      client_id_metadata_document_supported: true, so clients identify themselves with a
      client-ID metadata document URL rather than pre-registering.
scopes:
- scope: mcp
  description: >-
    Access the Cloud9 MCP server at https://cloud9.gg/wp-json/mcp/mcp-oauth-server. Coarse,
    single-scope model — the authorization server advertises no finer-grained read/write split,
    so a token that can read content can also invoke any write ability the adapter registered.
  flows: [authorizationCode]
  sources: [https://cloud9.gg/.well-known/oauth-authorization-server]
  protected_resource: https://cloud9.gg/wp-json/mcp/mcp-oauth-server
not_applicable:
- surface: Cloud9 WordPress REST API (wp/v2)
  reason: >-
    No OAuth. Anonymous reads require no credential; writes are authenticated with WordPress
    application passwords issued at /wp-admin/authorize-application.php. There is no scope
    surface to record — WordPress capabilities/roles do the authorization.
- surface: Cloud9 Store JSON endpoints (Shopify)
  reason: Anonymous platform endpoints. No authorization surface is exposed publicly.
x-evidence:
  fetched: '2026-08-09'
  probes:
  - url: https://cloud9.gg/.well-known/oauth-authorization-server
    status: 200
  - url: https://cloud9.gg/.well-known/oauth-protected-resource
    status: 200
  - url: https://cloud9.gg/.well-known/openid-configuration
    status: 404