DataForSEO · OAuth Scopes

DataForSEO OAuth Scopes

OAuth 2.0 probed

DataForSEO publishes 2 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the DataForSEO API on a user’s behalf.

Tokens are issued from https://data.dataforseo.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

SEOSERPKeywordsBacklinksDomain AnalyticsOn-Page SEOCompetitor ResearchSearch EnginesContent AnalysisE-CommerceApp StoreBusiness DataAI OptimizationSocial-Media

Scopes: 2 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://data.dataforseo.com/oauth/authorize

Token URL
https://data.dataforseo.com/oauth/token

Flows
authorizationCode

Scopes (2)

Scope	Description	Flows
api	Access to the DataForSEO API through the authorized surface. Advertised in `scopes_supported`; no further definition is published, so the exact privilege boundary is not documented.	authorizationCode
profile	Access to the authenticated user's account profile. Advertised in `scopes_supported`; no further definition is published.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://data.dataforseo.com/.well-known/oauth-authorization-server
docs: null
docs_note: >-
  DataForSEO publishes no scopes/permissions reference page. The scope set below
  was read from the live RFC 8414 authorization-server metadata document, not
  from documentation. The MCP server README describes OAuth as "works out of the
  box" and never names a scope.

applies_to:
  surface: MCP
  resource: https://mcp.dataforseo.com
  note: >-
    OAuth 2.0 applies ONLY to the hosted MCP server. The v3 REST API at
    api.dataforseo.com is HTTP Basic only and has no OAuth surface and no
    scopes — the 12 OpenAPI documents in openapi/ declare a single `basicAuth`
    securityScheme and nothing else.

schemes:
  - name: oauth2
    source: https://data.dataforseo.com/.well-known/oauth-authorization-server
    issuer: https://data.dataforseo.com
    flows:
      - flow: authorizationCode
        authorizationUrl: https://data.dataforseo.com/oauth/authorize
        tokenUrl: https://data.dataforseo.com/oauth/token
        refresh: true
    pkce_methods: [S256]
    response_types: [code]
    grant_types: [authorization_code, refresh_token]
    token_endpoint_auth_methods: [none]
    registration_endpoint: https://data.dataforseo.com/oauth/clients/register
    revocation_endpoint: https://data.dataforseo.com/oauth/tokens/revoke
    dynamic_client_registration: true
    dynamic_client_registration_spec: RFC 7591

scopes:
  - scope: api
    description: >-
      Access to the DataForSEO API through the authorized surface. Advertised in
      `scopes_supported`; no further definition is published, so the exact
      privilege boundary is not documented.
    flows: [authorizationCode]
    sources: [https://data.dataforseo.com/.well-known/oauth-authorization-server]
  - scope: profile
    description: >-
      Access to the authenticated user's account profile. Advertised in
      `scopes_supported`; no further definition is published.
    flows: [authorizationCode]
    sources: [https://data.dataforseo.com/.well-known/oauth-authorization-server]

protected_resource:
  spec: RFC 9728
  metadata:
    - url: https://mcp.dataforseo.com/.well-known/oauth-protected-resource
      resource: https://mcp.dataforseo.com
    - url: https://mcp.dataforseo.com/.well-known/oauth-protected-resource/mcp
      resource: https://mcp.dataforseo.com/mcp
  authorization_servers: [https://data.dataforseo.com]
  bearer_methods_supported: [header]

granularity_note: >-
  Two coarse scopes for an API with 554 operations spanning SERP scraping,
  keyword data, backlinks, on-page crawling and paid AI-optimization endpoints.
  A token bearing `api` can spend account balance on any of them; there is no
  read-only scope, no per-product scope and no spend-bounded scope. An agent
  operator should rely on the account-level cost limits and IP whitelisting in
  the DataForSEO dashboard (status codes 40203 and 40207) rather than on scope
  restriction.

x-evidence:
  fetched: '2026-08-13'
  url: https://data.dataforseo.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json
  file: well-known/dataforseo-oauth-authorization-server.json