Clozd · OAuth Scopes

Clozd OAuth Scopes

OAuth 2.0 searched

Clozd publishes 5 OAuth 2.0 scopes via the authorizationCode, clientCredentials, and refreshToken flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Clozd API on a user’s behalf.

Tokens are issued from https://oauth.clozd.com/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

win-loss-analysiscustomer-feedbackdecision-intelligencesales-intelligencemarket-researchcompetitive-intelligencevoice-of-customerrevenue-intelligencesaasmcpagent-native

Scopes: 5 Flows: authorizationCode, clientCredentials, refreshToken Method: searched

OAuth endpoints

Authorization URL
https://oauth.clozd.com/authorize

Token URL
https://oauth.clozd.com/token

Flows
authorizationCodeclientCredentialsrefreshToken

Scopes (5)

Scope	Description	Flows
openid	OpenID Connect authentication — issues an ID token identifying the Clozd user.	authorizationCode
profile	Access to the authenticated user's basic profile claims.	authorizationCode
email	Access to the authenticated user's email address claim.	authorizationCode
offline_access	Issues a refresh token so an MCP client can keep the connection alive without re-prompting the user for interactive login.	authorizationCode, refreshToken
api	Access to the Clozd API/MCP resource. Single coarse-grained resource scope — the data a token can reach is determined by the user's platform role and the programs an admin has scoped to them, not by the scope string.	authorizationCode, clientCredentials

📄 Provider scope reference: https://help.clozd.com/hc/en-us/articles/49656607624987-Connecting-to-Clozd-via-MCP

Source

OAuth Scopes

generated: '2026-08-04'
method: searched
source: https://oauth.clozd.com/.well-known/oauth-authorization-server
docs: https://help.clozd.com/hc/en-us/articles/49656607624987-Connecting-to-Clozd-via-MCP
note: >-
  Clozd's OpenAPI Data API (v1/v2/v3) declares no oauth2 security scheme — it is API-key only — so this
  artifact is derived entirely from the OAuth 2.0 authorization server that protects the Clozd MCP server.
  Clozd publishes no per-tool or per-resource scope reference beyond the scopes_supported list below;
  authorization inside the platform is enforced by role-based access control on the authenticated user and
  by the program scoping an admin grants, not by fine-grained OAuth scopes.
applies_to:
  api: Clozd MCP Server
  resource: https://mcp.clozd.com/mcp
schemes:
- name: Clozd OAuth 2.0 / OIDC
  issuer: https://oauth.clozd.com
  source: https://oauth.clozd.com/.well-known/oauth-authorization-server
  flows:
  - flow: authorizationCode
    authorizationUrl: https://oauth.clozd.com/authorize
    tokenUrl: https://oauth.clozd.com/token
    pkce: S256
  - flow: clientCredentials
    tokenUrl: https://oauth.clozd.com/token
  - flow: refreshToken
    tokenUrl: https://oauth.clozd.com/token
  endpoints:
    userinfo: https://oauth.clozd.com/userinfo
    revocation: https://oauth.clozd.com/revoke
    introspection: https://oauth.clozd.com/introspect
    jwks: https://oauth.clozd.com/.well-known/jwks.json
    dynamic_client_registration: https://oauth.clozd.com/register
scopes:
- scope: openid
  description: OpenID Connect authentication — issues an ID token identifying the Clozd user.
  standard: OpenID Connect Core 1.0
  flows:
  - authorizationCode
  sources:
  - https://oauth.clozd.com/.well-known/openid-configuration
- scope: profile
  description: Access to the authenticated user's basic profile claims.
  standard: OpenID Connect Core 1.0
  flows:
  - authorizationCode
  sources:
  - https://oauth.clozd.com/.well-known/openid-configuration
- scope: email
  description: Access to the authenticated user's email address claim.
  standard: OpenID Connect Core 1.0
  flows:
  - authorizationCode
  sources:
  - https://oauth.clozd.com/.well-known/openid-configuration
- scope: offline_access
  description: >-
    Issues a refresh token so an MCP client can keep the connection alive without re-prompting the user for
    interactive login.
  standard: OpenID Connect Core 1.0
  flows:
  - authorizationCode
  - refreshToken
  sources:
  - https://oauth.clozd.com/.well-known/openid-configuration
- scope: api
  description: >-
    Access to the Clozd API/MCP resource. Single coarse-grained resource scope — the data a token can reach
    is determined by the user's platform role and the programs an admin has scoped to them, not by the
    scope string.
  flows:
  - authorizationCode
  - clientCredentials
  sources:
  - https://oauth.clozd.com/.well-known/oauth-authorization-server
  - https://mcp.clozd.com/.well-known/oauth-protected-resource/mcp
granularity:
  model: coarse
  per_tool_scopes: false
  per_resource_scopes: false
  read_write_split: false
  note: >-
    A single `api` scope covers the whole MCP surface. Because every published MCP tool is read-only, the
    absence of a read/write split does not currently expose write operations to agents, but it also gives a
    consuming agent no way to request least privilege.
x-evidence:
  fetched: '2026-08-04'
  urls:
  - url: https://oauth.clozd.com/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json
  - url: https://oauth.clozd.com/.well-known/openid-configuration
    http_status: 200
    content_type: application/json
  - url: https://mcp.clozd.com/.well-known/oauth-protected-resource/mcp
    http_status: 200
    content_type: application/json