FuseWP uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.
This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.
FuseWP implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.
READ THIS BEFORE USING THE ROWS BELOW. FuseWP does not issue OAuth scopes of its own — it has no OAuth-protected product API for third parties to call. The one exception is the single `mcp` scope its WordPress MCP server advertises, recorded separately at the bottom. Everything in delegated_scopes[] is the reverse direction: the scope set FuseWP REQUESTS FROM each partner platform when a site administrator connects an account. Each row was read verbatim from the Location header of a live 302 issued by https://auth.fusewp.com/{integration_id} on 2026-08-12 — this is the access FuseWP actually asks for over your CRM, observed rather than documented. The provider publishes no scopes reference page; nothing here comes from prose. Partner client_id values are omitted deliberately: they are public but secret-shaped, and they are not the finding.
generated: '2026-08-12'
method: probed
source: https://auth.fusewp.com/
direction: outbound-delegated
note: >-
READ THIS BEFORE USING THE ROWS BELOW. FuseWP does not issue OAuth scopes of
its own — it has no OAuth-protected product API for third parties to call. The
one exception is the single `mcp` scope its WordPress MCP server advertises,
recorded separately at the bottom. Everything in delegated_scopes[] is the
reverse direction: the scope set FuseWP REQUESTS FROM each partner platform
when a site administrator connects an account. Each row was read verbatim from
the Location header of a live 302 issued by
https://auth.fusewp.com/{integration_id} on 2026-08-12 — this is the access
FuseWP actually asks for over your CRM, observed rather than documented. The
provider publishes no scopes reference page; nothing here comes from prose.
Partner client_id values are omitted deliberately: they are public but
secret-shaped, and they are not the finding.
issued_scopes:
- scope: mcp
description: >-
The only scope FuseWP itself issues. Advertised in both
/.well-known/oauth-authorization-server and
/.well-known/oauth-protected-resource; gates the MCP endpoint at
https://fusewp.com/wp-json/mcp/mcp-oauth-server.
flows: [authorizationCode]
pkce: S256
sources: [well-known/fusewp-oauth-authorization-server.json]
delegated_scopes:
- integration_id: aweber
partner: AWeber
authorize_host: auth.aweber.com
scopes: [account.read, list.read, list.write, subscriber.read, subscriber.write, email.write]
status: 302
- integration_id: birdsend
partner: BirdSend
authorize_host: app.birdsend.co
scopes: [read, write]
status: 302
- integration_id: campaignmonitor
partner: Campaign Monitor
authorize_host: api.createsend.com
scopes: [ManageLists, ImportSubscribers, CreateCampaigns, SendCampaigns]
status: 302
note: State parameter present; scope delimiter is a comma on this partner.
- integration_id: constantcontact
partner: Constant Contact
authorize_host: authz.constantcontact.com
scopes: [contact_data, campaign_data, offline_access]
status: 302
- integration_id: copper
partner: Copper CRM
authorize_host: app.copper.com
scopes: ['developer/v1/all']
status: 302
note: >-
Copper exposes no granular scopes — the only value available is full
developer API access.
- integration_id: gohl
partner: GoHighLevel
authorize_host: marketplace.gohighlevel.com
scopes: [contacts.write, contacts.readonly, workflows.readonly, 'locations/tags.write',
'locations/tags.readonly', 'locations/customFields.readonly', 'locations/customFields.write']
status: 302
- integration_id: hubspot
partner: HubSpot
authorize_host: app.hubspot.com
scopes: [oauth, crm.objects.owners.read, crm.objects.contacts.write, crm.lists.write,
crm.lists.read, crm.schemas.contacts.read, crm.objects.contacts.read]
status: 302
- integration_id: keap
partner: Keap / Infusionsoft
authorize_host: accounts.infusionsoft.com
scopes: [full]
status: 302
note: >-
Keap publishes only a single `full` scope, so connecting FuseWP grants
complete account access. A least-privilege limitation of the partner, not of
FuseWP.
- integration_id: mailchimp
partner: Mailchimp
authorize_host: login.mailchimp.com
scopes: []
status: 302
note: >-
Empty scope parameter — Mailchimp's OAuth2 grants full account access to the
authorizing user and defines no scope vocabulary.
- integration_id: zohocrm
partner: Zoho CRM
authorize_host: accounts.zoho.com
scopes: [ZohoCRM.modules.READ, ZohoCRM.modules.CREATE, ZohoCRM.modules.UPDATE,
ZohoCRM.users.READ, ZohoCRM.users.CREATE, ZohoCRM.users.UPDATE, ZohoCRM.settings.all]
status: 302
note: Requests access_type=offline and prompt=consent.
- integration_id: zohocampaigns
partner: Zoho Campaigns
authorize_host: accounts.zoho.com
scopes: [ZohoCampaigns.contact.CREATE, ZohoCampaigns.contact.READ, ZohoCampaigns.contact.UPDATE,
ZohoCampaigns.campaign.READ, ZohoCampaigns.campaign.CREATE, ZohoCampaigns.campaign.UPDATE]
status: 302
note: >-
The redirect_uri returned for this integration is
https://auth.fusewp.com/zohocrm rather than /zohocampaigns — the two Zoho
integrations share one registered OAuth application. Recorded as observed.
unresolved:
- integration_id: google_sheet
partner: Google Sheets
status: 500
- integration_id: salesforce
partner: Salesforce
status: 500
summary:
issued_scope_count: 1
delegated_integrations_probed: 13
delegated_integrations_resolved: 11
write_capable_integrations: 10
full_access_integrations: [keap, mailchimp, copper]
x-evidence:
fetched: '2026-08-12'
method: 'GET https://auth.fusewp.com/{integration_id}, Location header read without following'