Goody · OAuth Scopes

Goody OAuth Scopes

OAuth 2.0 searched

Goody publishes 4 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Goody API on a user’s behalf.

Tokens are issued from https://api.ongoody.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyRetailGiftingGift CardsE-CommerceCommercePaymentsMCPWebhooksRewards

Scopes: 4 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://api.ongoody.com/oauth/authorize

Token URL
https://api.ongoody.com/oauth/token

Flows
authorizationCode

Scopes (4)

Scope	Description	Flows
mcp.read	Read access via the MCP server / OAuth clients: list workspaces, search the catalog and contacts, price and preview gifts, read orders.	authorizationCode
mcp.write	Write access short of charging: create/update contacts and contact lists, cancel orders, build previews, pause autogift rules, submit feedback.	authorizationCode
mcp.gifts	Send gifts / spend money: create an order batch (charges the payment method) and create or activate autogift rules. Highest-consequence scope.	authorizationCode
chrome.write	Scope used by Goody's browser extension / Chrome client integration.	authorizationCode

📄 Provider scope reference: https://developer.ongoody.com/mcp/authentication

Source

OAuth Scopes

generated: '2026-07-19'
method: searched
source: well-known/goody-oauth-authorization-server.json
docs: https://developer.ongoody.com/mcp/authentication
schemes:
- name: mcp_oauth2
  source: well-known/goody-oauth-authorization-server.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.ongoody.com/oauth/authorize
    tokenUrl: https://api.ongoody.com/oauth/token
    pkce: S256
scopes:
- scope: mcp.read
  description: >-
    Read access via the MCP server / OAuth clients: list workspaces, search
    the catalog and contacts, price and preview gifts, read orders.
  flows: [authorizationCode]
  sources: [well-known/goody-oauth-authorization-server.json]
- scope: mcp.write
  description: >-
    Write access short of charging: create/update contacts and contact lists,
    cancel orders, build previews, pause autogift rules, submit feedback.
  flows: [authorizationCode]
  sources: [well-known/goody-oauth-authorization-server.json]
- scope: mcp.gifts
  description: >-
    Send gifts / spend money: create an order batch (charges the payment
    method) and create or activate autogift rules. Highest-consequence scope.
  flows: [authorizationCode]
  sources: [well-known/goody-oauth-authorization-server.json]
- scope: chrome.write
  description: >-
    Scope used by Goody's browser extension / Chrome client integration.
  flows: [authorizationCode]
  sources: [well-known/goody-oauth-authorization-server.json]
notes: >-
  The MCP permission model (Read / Write / Send gifts) maps directly onto the
  three mcp.* scopes. The REST Commerce/Automation API itself uses a bearer
  API key with no scope surface; these scopes govern the OAuth/MCP path only.