Inrupt · OAuth Scopes

Inrupt OAuth Scopes

OAuth 2.0 probed

Inrupt uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanySolidPersonal Data StoresDecentralized IdentityData PrivacyAccess ControlVerifiable CredentialsLinked DataRDFConsent ManagementData WalletsAgent InfrastructureModel Context ProtocolEnterprise Software

Scopes: 0 Flows: Method: probed

Scopes (0)

Inrupt implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

Inrupt's Solid OpenID Provider advertises three scopes and no resource-level permission scopes. This is by design and is the most important thing to understand about authorizing against ESS: authorization is NOT carried in the OAuth scope. A token grants an identity (the WebID); what that identity may read or write is decided separately by Access Control Policies on the resource and by Access Grants, which are W3C Verifiable Credentials issued by the data subject. There is therefore no scope reference page to enumerate, and the absence of granular scopes is not a documentation gap.

📄 Provider scope reference: https://docs.inrupt.com/guides/authentication-in-solid

Source

OAuth Scopes

generated: '2026-08-23'
method: probed
source: https://login.inrupt.com/.well-known/openid-configuration
docs: https://docs.inrupt.com/guides/authentication-in-solid
issuer: https://login.inrupt.com
note: >-
  Inrupt's Solid OpenID Provider advertises three scopes and no resource-level permission scopes.
  This is by design and is the most important thing to understand about authorizing against ESS:
  authorization is NOT carried in the OAuth scope. A token grants an identity (the WebID); what that
  identity may read or write is decided separately by Access Control Policies on the resource and by
  Access Grants, which are W3C Verifiable Credentials issued by the data subject. There is therefore
  no scope reference page to enumerate, and the absence of granular scopes is not a documentation gap.
scopes:
- name: openid
  description: Standard OpenID Connect scope requesting an ID token.
  required: true
- name: offline_access
  description: Requests a refresh token so a session can be restored without re-authenticating.
- name: webid
  description: >-
    Solid-OIDC scope requesting the webid claim, which binds the token to the user's WebID URI. Present
    in both scopes_supported and claims_supported.
authorization_model:
  identity_scopes: OAuth/OIDC scopes above
  resource_authorization:
  - mechanism: Access Control Policy (ACP)
    docs: https://docs.inrupt.com/security/authorization/acp
    description: Policies on the Access Control Resource attached to each Pod resource.
  - mechanism: Access Requests and Access Grants
    docs: https://docs.inrupt.com/security/authorization/access-requests-grants
    description: >-
      Verifiable Credentials issued by the data subject naming grantee, resource, access modes and
      purpose, with expiry and revocation. As of ESS 3.0 a grant acts as a receipt checked server-side.
  access_modes:
  - read
  - write
  - append
  - control
  mcp_restriction: >-
    The MCP Resource Service currently supports only the read access mode for requestAccess and
    hasMatchingAccessGrant.
token_endpoint_auth_methods:
- client_secret_basic
- client_secret_post
grant_types:
- authorization_code
- refresh_token
- client_credentials
pkce:
- plain
- S256
dpop_signing_algs:
- RS256
- ES256
dynamic_client_registration: https://login.inrupt.com/registration

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/inrupt-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.