Inflection.io OAuth Scopes

generated: '2026-08-13'
method: searched
source: https://docs.inflection.io/agents/connected-apps-oauth
docs: https://docs.inflection.io/agents/connected-apps-oauth
discovery: https://auth-v2.inflection.io/.well-known/oauth-authorization-server
note: >-
  The OpenAPI declares only an http/bearer securityScheme, so nothing about OAuth is derivable from the
  spec. Inflection nonetheless runs a full OAuth 2.1 + PKCE authorization server for Connected Apps,
  documented in the developer docs and discoverable anonymously via RFC 8414 metadata. Scopes below are
  read from that live metadata document and from the docs' authorization-request reference. Scope
  granularity is coarse: a single application scope (inflection_app) grants the app the acting user's
  own permissions, so authorization is by USER ROLE, not by scope.
schemes:
- name: OAuth 2.1 Connected App
  type: oauth2
  source: https://docs.inflection.io/agents/connected-apps-oauth
  pkce: required
  pkce_methods: [S256]
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth-v2.inflection.io/oauth2/authorize
    tokenUrl: https://auth-v2.inflection.io/oauth2/token
    refreshUrl: https://auth-v2.inflection.io/oauth2/token
    revocationUrl: https://auth-v2.inflection.io/oauth2/revoke
    introspectionUrl: https://auth-v2.inflection.io/oauth2/introspect
    jwksUri: https://auth-v2.inflection.io/oauth2/jwks
    registrationUrl: https://auth-v2.inflection.io/client-app/connect/register
    grant_types: [authorization_code, refresh_token]
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, private_key_jwt]
scopes:
- scope: inflection_app
  description: >-
    The application scope required on every authorization request. Grants the connected app the
    permissions of the user who authorized it — admins and members read and write, viewers are
    read-only. Also the only scope advertised by the MCP protected-resource metadata.
  flows: [authorizationCode]
  required: true
  sources:
  - https://auth-v2.inflection.io/.well-known/oauth-authorization-server
  - https://mcp.inflection.io/.well-known/oauth-protected-resource
  - https://docs.inflection.io/agents/connected-apps-oauth
- scope: profile
  description: Advertised in the authorization server's scopes_supported. Not documented in the Connected Apps guide.
  flows: [authorizationCode]
  sources: [https://auth-v2.inflection.io/.well-known/oauth-authorization-server]
- scope: email
  description: Advertised in the authorization server's scopes_supported. Not documented in the Connected Apps guide.
  flows: [authorizationCode]
  sources: [https://auth-v2.inflection.io/.well-known/oauth-authorization-server]
pat_permissions:
  note: >-
    Personal Access Tokens are the other credential type and carry coarse permissions rather than OAuth
    scopes. PATs do not work against the MCP server.
  permissions:
  - {name: READ, description: Required for every GET request.}
  - {name: WRITE, description: Required for POST, PATCH and DELETE requests.}
token_lifetimes:
  oauth_access_token_seconds: 900
  oauth_access_token_note: 15-minute access-token lifetime with refresh-token rotation and reuse detection (MCP trust page).
  authorization_code_seconds: 300
  authorization_code_note: Authorization codes are valid for 5 minutes and are single-use; reuse invalidates the session.
  pat: long-lived until revoked
see:
- authentication/inflectionio-authentication.yml
- mcp/inflectionio-mcp.yml
- well-known/inflectionio-well-known.yml