Highspot · OAuth Scopes

Highspot OAuth Scopes

OAuth 2.0 probed

Highspot publishes 3 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the Highspot API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Sales EnablementContent ManagementPitch AnalyticsCRM IntegrationBuyer EngagementTrainingCoachingArtificial IntelligenceMCP Server

Scopes: 3 Flows: Method: probed

Scopes (3)

Scope	Description	Flows
mcp:read	Read access through the Highspot MCP server — search content, retrieve items, request instant answers and analytics-backed responses.
mcp:write	Write access through the Highspot MCP server — create linked pitches, generate Digital Rooms, and invoke Highspot Agents that take action.
offline_access	Issue a refresh token so an agent can keep operating without a fresh interactive authorization.

📄 Provider scope reference: https://www.highspot.com/product/mcp-server/

Source

OAuth Scopes

name: Highspot OAuth Scopes
description: >-
  OAuth 2.1 scopes Highspot advertises for its remote MCP server. Read directly from
  the two machine-readable discovery documents Highspot serves — RFC 8414
  authorization server metadata on app.highspot.com and RFC 9728 protected resource
  metadata on mcp.highspot.com — not from prose. Both documents agree on the same
  three scopes. Highspot's REST API (api-{instance}.highspot.com/v1.0) does NOT use
  OAuth scopes; it authenticates with an API client key and secret pair, so no scope
  vocabulary exists for it.
generated: '2026-08-14'
method: probed
source: https://mcp.highspot.com/.well-known/oauth-protected-resource/mcp
docs: https://www.highspot.com/product/mcp-server/
checked: '2026-08-14'

authorization_server:
  issuer: https://app.highspot.com
  metadata_url: https://app.highspot.com/.well-known/oauth-authorization-server
  authorization_endpoint: https://app.highspot.com/oauth2/v1/authorize
  token_endpoint: https://app.highspot.com/auth/oauth2/v1/token
  registration_endpoint: https://app.highspot.com/auth/oauth2/v1/register
  grant_types_supported:
    - authorization_code
    - refresh_token
  response_types_supported:
    - code
  token_endpoint_auth_methods_supported:
    - client_secret_post
    - none
  code_challenge_methods_supported:
    - S256
    - plain

protected_resource:
  resource: https://mcp.highspot.com/mcp
  metadata_url: https://mcp.highspot.com/.well-known/oauth-protected-resource/mcp
  authorization_servers:
    - https://app.highspot.com/auth/

scopes:
  - scope: mcp:read
    description: >-
      Read access through the Highspot MCP server — search content, retrieve items,
      request instant answers and analytics-backed responses.
    type: read
    source: https://mcp.highspot.com/.well-known/oauth-protected-resource/mcp
  - scope: mcp:write
    description: >-
      Write access through the Highspot MCP server — create linked pitches, generate
      Digital Rooms, and invoke Highspot Agents that take action.
    type: write
    source: https://mcp.highspot.com/.well-known/oauth-protected-resource/mcp
  - scope: offline_access
    description: >-
      Issue a refresh token so an agent can keep operating without a fresh interactive
      authorization.
    type: session
    source: https://mcp.highspot.com/.well-known/oauth-protected-resource/mcp

scope_count: 3

notes:
  - >-
    Scope granularity is coarse: two scopes cover every read and every write across
    content, pitches, Digital Rooms and agent invocation. There is no per-resource or
    per-spot scope, so an agent granted mcp:write can create pitches and rooms on the
    user's behalf with no narrower consent step.
  - >-
    plain is advertised alongside S256 in code_challenge_methods_supported. S256 is
    the only method MCP clients should use.
  - >-
    No corresponding scope vocabulary exists for the REST API; see
    authentication/highspot-authentication.yml.