CustomDomain OAuth Scopes

generated: '2026-11-04'
method: searched
source: https://docs.customdomain.ai/docs/authentication/overview
schemes:
- name: agentToken
  source: openapi/customdomain-ai-openapi.yml
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.customdomain.ai/oauth/agent/authorize
    tokenUrl: https://api.customdomain.ai/oauth/agent/token
  description: 'A delegated agent access token: an ES256 JWT that lives 15 minutes, sent as a bearer token. A person
    approves an agent in the console and the agent exchanges its authorization code (with PKCE) at the token endpoint.
    The token carries the workspace, the one application the grant is bound to, the grant, the approved scopes and
    its audience, and is verified against `/.well-known/jwks.json`. A route that accepts it lists the scope it needs;
    a token without the scope is refused with `403`, and a connection or order of another application answers `404`.'
scopes:
- scope: domains:connect
  description: Connect a domain, recheck it, reapply its records and start a one click setup.
  flows:
  - authorizationCode
  sources:
  - openapi/customdomain-ai-openapi.yml
- scope: domains:disconnect
  description: Remove a connected domain. The call must name the domain.
  flows:
  - authorizationCode
  sources:
  - openapi/customdomain-ai-openapi.yml
- scope: domains:purchase
  description: Buy a domain, up to the grant's monthly spend cap.
  flows:
  - authorizationCode
  sources:
  - openapi/customdomain-ai-openapi.yml
- scope: domains:read
  description: Look at availability, connections, records, certificates, diagnoses, orders and the billing standing.
  flows:
  - authorizationCode
  sources:
  - openapi/customdomain-ai-openapi.yml
docs: https://docs.customdomain.ai/docs/agents/oauth-flow
note: Scopes apply only to delegated agent tokens (approved by a person in the console, authorization code with
  PKCE). Tenant API keys are not scoped; their authority comes from the key kind and member role.