Inflection.io · OAuth Scopes

Inflection.io OAuth Scopes

OAuth 2.0 searched

Inflection.io publishes 3 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Inflection.io API on a user’s behalf.

Tokens are issued from https://auth-v2.inflection.io/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanySaasMarketingMarketing AutomationEmail MarketingCustomer DataB2BContactsAPIMCPAgentsArtificial IntelligenceCustomer JourneysWebhooks

Scopes: 3 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://auth-v2.inflection.io/oauth2/authorize

Token URL
https://auth-v2.inflection.io/oauth2/token

Flows
authorizationCode

Scopes (3)

Scope	Description	Flows
inflection_app	The application scope required on every authorization request. Grants the connected app the permissions of the user who authorized it — admins and members read and write, viewers are read-only. Also the only scope advertised by the MCP protected-resource metadata.	authorizationCode
profile	Advertised in the authorization server's scopes_supported. Not documented in the Connected Apps guide.	authorizationCode
email	Advertised in the authorization server's scopes_supported. Not documented in the Connected Apps guide.	authorizationCode

📄 Provider scope reference: https://docs.inflection.io/agents/connected-apps-oauth

Source

OAuth Scopes

generated: '2026-08-13'
method: searched
source: https://docs.inflection.io/agents/connected-apps-oauth
docs: https://docs.inflection.io/agents/connected-apps-oauth
discovery: https://auth-v2.inflection.io/.well-known/oauth-authorization-server
note: >-
  The OpenAPI declares only an http/bearer securityScheme, so nothing about OAuth is derivable from the
  spec. Inflection nonetheless runs a full OAuth 2.1 + PKCE authorization server for Connected Apps,
  documented in the developer docs and discoverable anonymously via RFC 8414 metadata. Scopes below are
  read from that live metadata document and from the docs' authorization-request reference. Scope
  granularity is coarse: a single application scope (inflection_app) grants the app the acting user's
  own permissions, so authorization is by USER ROLE, not by scope.
schemes:
- name: OAuth 2.1 Connected App
  type: oauth2
  source: https://docs.inflection.io/agents/connected-apps-oauth
  pkce: required
  pkce_methods: [S256]
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth-v2.inflection.io/oauth2/authorize
    tokenUrl: https://auth-v2.inflection.io/oauth2/token
    refreshUrl: https://auth-v2.inflection.io/oauth2/token
    revocationUrl: https://auth-v2.inflection.io/oauth2/revoke
    introspectionUrl: https://auth-v2.inflection.io/oauth2/introspect
    jwksUri: https://auth-v2.inflection.io/oauth2/jwks
    registrationUrl: https://auth-v2.inflection.io/client-app/connect/register
    grant_types: [authorization_code, refresh_token]
    token_endpoint_auth_methods: [client_secret_basic, client_secret_post, private_key_jwt]
scopes:
- scope: inflection_app
  description: >-
    The application scope required on every authorization request. Grants the connected app the
    permissions of the user who authorized it — admins and members read and write, viewers are
    read-only. Also the only scope advertised by the MCP protected-resource metadata.
  flows: [authorizationCode]
  required: true
  sources:
  - https://auth-v2.inflection.io/.well-known/oauth-authorization-server
  - https://mcp.inflection.io/.well-known/oauth-protected-resource
  - https://docs.inflection.io/agents/connected-apps-oauth
- scope: profile
  description: Advertised in the authorization server's scopes_supported. Not documented in the Connected Apps guide.
  flows: [authorizationCode]
  sources: [https://auth-v2.inflection.io/.well-known/oauth-authorization-server]
- scope: email
  description: Advertised in the authorization server's scopes_supported. Not documented in the Connected Apps guide.
  flows: [authorizationCode]
  sources: [https://auth-v2.inflection.io/.well-known/oauth-authorization-server]
pat_permissions:
  note: >-
    Personal Access Tokens are the other credential type and carry coarse permissions rather than OAuth
    scopes. PATs do not work against the MCP server.
  permissions:
  - {name: READ, description: Required for every GET request.}
  - {name: WRITE, description: Required for POST, PATCH and DELETE requests.}
token_lifetimes:
  oauth_access_token_seconds: 900
  oauth_access_token_note: 15-minute access-token lifetime with refresh-token rotation and reuse detection (MCP trust page).
  authorization_code_seconds: 300
  authorization_code_note: Authorization codes are valid for 5 minutes and are single-use; reuse invalidates the session.
  pat: long-lived until revoked
see:
- authentication/inflectionio-authentication.yml
- mcp/inflectionio-mcp.yml
- well-known/inflectionio-well-known.yml