Firefly · OAuth Scopes

Firefly OAuth Scopes

OAuth 2.0 probed

Firefly publishes 14 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the Firefly API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyAdvertisingDigital Out-of-HomeDOOHMobilityAdvertising TechnologyAdTechMarketingMeasurementProgrammatic Advertising

Scopes: 14 Flows: Method: probed

Scopes (14)

Scope	Description	Flows
openid	Standard OIDC scope — requests an ID token for the authenticated subject.
profile	Standard OIDC scope — the default profile claim set (name, family_name, given_name, nickname, picture, updated_at).
offline_access	Standard OIDC scope — requests a refresh token for long-lived access.
email	Standard OIDC scope — releases the email claim.
address	Standard OIDC scope — releases the address claim.
phone	Standard OIDC scope — releases the phone_number claim.
name	Auth0 granular profile scope — releases the name claim alone.
given_name	Auth0 granular profile scope — releases the given_name claim alone.
family_name	Auth0 granular profile scope — releases the family_name claim alone.
nickname	Auth0 granular profile scope — releases the nickname claim alone.
picture	Auth0 granular profile scope — releases the picture claim alone.
email_verified	Auth0 granular profile scope — releases the email_verified claim alone.
created_at	Auth0 granular profile scope — releases the account created_at claim.
identities	Auth0 granular profile scope — releases the linked-identities claim.

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-12'
method: probed
source: https://auth.fireflyon.com/.well-known/openid-configuration
docs: null
description: >-
  The complete scopes_supported list published by Firefly's Auth0 custom-domain tenant,
  read verbatim from the live OpenID Connect discovery document (HTTP 200, 2026-08-12)
  and saved at well-known/firefly-openid-configuration.json. IMPORTANT READING NOTE:
  every scope below is a standard OpenID Connect / Auth0 profile claim scope. Firefly
  publishes NO product or resource scopes (nothing shaped like campaign:read,
  inventory:write, reporting:export), and no scope reference page exists anywhere on
  fireflyon.com. Authorization for the advertiser dashboard gateway
  (audience https://gw.fireflyon.com) is therefore not expressed through discoverable
  scopes; whatever permission model it uses is not publicly readable. This artifact
  records the identity scopes that ARE published, and records the absence of API scopes
  as the finding.
schemes:
- name: firefly-dashboard-oidc
  type: openIdConnect
  issuer: https://auth.fireflyon.com/
  openIdConnectUrl: https://auth.fireflyon.com/.well-known/openid-configuration
  grant_types:
  - authorization_code
  - client_credentials
  - refresh_token
  - urn:ietf:params:oauth:grant-type:device_code
  pkce: S256
scope_count: 14
scopes:
- scope: openid
  description: Standard OIDC scope — requests an ID token for the authenticated subject.
  standard: openid-connect-core
  schemes: [firefly-dashboard-oidc]
- scope: profile
  description: Standard OIDC scope — the default profile claim set (name, family_name, given_name, nickname, picture, updated_at).
  standard: openid-connect-core
  schemes: [firefly-dashboard-oidc]
- scope: offline_access
  description: Standard OIDC scope — requests a refresh token for long-lived access.
  standard: openid-connect-core
  schemes: [firefly-dashboard-oidc]
- scope: email
  description: Standard OIDC scope — releases the email claim.
  standard: openid-connect-core
  schemes: [firefly-dashboard-oidc]
- scope: address
  description: Standard OIDC scope — releases the address claim.
  standard: openid-connect-core
  schemes: [firefly-dashboard-oidc]
- scope: phone
  description: Standard OIDC scope — releases the phone_number claim.
  standard: openid-connect-core
  schemes: [firefly-dashboard-oidc]
- scope: name
  description: Auth0 granular profile scope — releases the name claim alone.
  standard: auth0-profile-scope
  schemes: [firefly-dashboard-oidc]
- scope: given_name
  description: Auth0 granular profile scope — releases the given_name claim alone.
  standard: auth0-profile-scope
  schemes: [firefly-dashboard-oidc]
- scope: family_name
  description: Auth0 granular profile scope — releases the family_name claim alone.
  standard: auth0-profile-scope
  schemes: [firefly-dashboard-oidc]
- scope: nickname
  description: Auth0 granular profile scope — releases the nickname claim alone.
  standard: auth0-profile-scope
  schemes: [firefly-dashboard-oidc]
- scope: picture
  description: Auth0 granular profile scope — releases the picture claim alone.
  standard: auth0-profile-scope
  schemes: [firefly-dashboard-oidc]
- scope: email_verified
  description: Auth0 granular profile scope — releases the email_verified claim alone.
  standard: auth0-profile-scope
  schemes: [firefly-dashboard-oidc]
- scope: created_at
  description: Auth0 granular profile scope — releases the account created_at claim.
  standard: auth0-profile-scope
  schemes: [firefly-dashboard-oidc]
- scope: identities
  description: Auth0 granular profile scope — releases the linked-identities claim.
  standard: auth0-profile-scope
  schemes: [firefly-dashboard-oidc]
findings:
- id: no-product-scopes-published
  severity: informational
  detail: >-
    Zero of the 14 published scopes describe a Firefly resource. An integrator or agent
    cannot determine, from anything Firefly publishes, what an access token for
    https://gw.fireflyon.com is permitted to do.
  evidence:
  - url: https://auth.fireflyon.com/.well-known/openid-configuration
    status: 200
  - url: https://app-gw.api.fireflyon.com/.well-known/oauth-protected-resource
    status: 404
x-evidence:
  fetched: '2026-08-12'
  probes:
  - url: https://auth.fireflyon.com/.well-known/openid-configuration
    status: 200
  - url: https://auth.fireflyon.com/.well-known/oauth-authorization-server
    status: 200