Klue OAuth Scopes

generated: '2026-08-14'
method: probed
source: https://app.klue.com/.well-known/openid-configuration
docs: null
docs_note: >-
  Klue publishes no public scopes / permissions reference page. The scope list
  below is read verbatim from Klue's own OpenID Connect discovery document,
  which app.klue.com serves anonymously at HTTP 200. Descriptions are NOT
  published by Klue; where a description appears below it is marked as an
  API Evangelist reading of the scope name and is not a Klue claim.
scope_count: 23
schemes:
- name: klue-oauth2
  type: oauth2
  source: https://app.klue.com/.well-known/openid-configuration
  issuer: https://app.klue.com
  implementation_note: >-
    The kluein GitHub organization maintains a fork of devise-doorkeeper
    (https://github.com/kluein/devise-doorkeeper), the Rails Doorkeeper OAuth2
    provider integration; the endpoint layout below matches a Doorkeeper
    deployment.
  flows:
  - flow: authorizationCode
    authorizationUrl: https://app.klue.com/oauth/authorize
    tokenUrl: https://app.klue.com/oauth/token
    refreshUrl: https://app.klue.com/oauth/token
  grant_types_supported:
  - authorization_code
  - refresh_token
  response_types_supported:
  - code
  code_challenge_methods_supported:
  - plain
  - S256
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  endpoints:
    authorization: https://app.klue.com/oauth/authorize
    token: https://app.klue.com/oauth/token
    revocation: https://app.klue.com/oauth/revoke
    introspection: https://app.klue.com/oauth/introspect
    userinfo: https://app.klue.com/oauth/userinfo
    jwks: https://app.klue.com/oauth/discovery/keys
    dynamic_client_registration: https://app.klue.com/oauth/register
scopes:
- scope: openid
  description: OpenID Connect authentication; returns an RS256-signed ID token.
  standard: OpenID Connect Core 1.0
  sources: [well-known/klue-openid-configuration.json]
- scope: content:read
  description: >-
    Read access to Klue content (cards, battlecards). API Evangelist reading —
    Klue publishes no description; the name aligns with the read surface of the
    Klue Content API and the v1 MCP connector.
  sources: [well-known/klue-openid-configuration.json]
- scope: content:edit
  description: >-
    Write access to Klue content. API Evangelist reading — aligns with the
    create/update/delete card and battlecard tooling Klue describes as the
    "admin MCP endpoint" writeback surface.
  sources: [well-known/klue-openid-configuration.json]
- scope: win_loss:read
  description: >-
    Read access to win-loss interviews, transcripts and reports. API Evangelist
    reading — aligns with the win-loss MCP tool family.
  sources: [well-known/klue-openid-configuration.json]
- scope: deal_answers:read
  description: >-
    Read access to deal answers. API Evangelist reading — likely the Smart
    Answers / Deal Tips surface.
  sources: [well-known/klue-openid-configuration.json]
- scope: auto_insights:read
  description: >-
    Read access to Auto Insights, Klue's AI-generated insight pipeline.
    API Evangelist reading; the v2 MCP connector exposes search_agent_insights.
  sources: [well-known/klue-openid-configuration.json]
- scope: deal_context:read
  description: Read access to deal context. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: transcript:edit
  description: Write access to interview transcripts. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: crm:edit
  description: >-
    Write access to the connected CRM surface. API Evangelist reading; Klue
    integrates with Salesforce, HubSpot and MS Dynamics.
  sources: [well-known/klue-openid-configuration.json]
- scope: stak_play_mcp:read
  description: >-
    Read scope for Klue's MCP surface. API Evangelist reading — this is the only
    scope in the published set whose name contains "mcp", and it is the strongest
    public evidence that the Klue MCP server authorizes over OAuth rather than
    only over a bearer API key.
  sources: [well-known/klue-openid-configuration.json]
- scope: stak_play_mcp:edit
  description: >-
    Write/writeback scope for Klue's MCP surface. API Evangelist reading; matches
    Klue's claim of being the only competitive intelligence MCP server supporting
    writeback.
  sources: [well-known/klue-openid-configuration.json]
- scope: scim:read
  description: >-
    SCIM 2.0 read. API Evangelist reading; the kluein GitHub organization
    maintains a fork of scimitar, a Rails SCIM v2 endpoint implementation.
  sources: [well-known/klue-openid-configuration.json]
- scope: scim:edit
  description: SCIM 2.0 write (user/group provisioning). API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: slack
  description: Slack integration scope. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: teams
  description: Microsoft Teams integration scope. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: connect
  description: Generic connect/integration scope. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: usage_reports:read
  description: Read access to usage reporting. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: service_read
  description: Service-to-service read scope. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: service_write
  description: Service-to-service write scope. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: customer_success
  description: Internal customer-success scope. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: impersonate
  description: >-
    User-impersonation scope. API Evangelist reading; an internal/support
    capability, not expected to be grantable to customer integrations.
  sources: [well-known/klue-openid-configuration.json]
- scope: alpha:read
  description: Read access to alpha/preview features. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
- scope: alpha:edit
  description: Write access to alpha/preview features. API Evangelist reading.
  sources: [well-known/klue-openid-configuration.json]
x-evidence:
- url: https://app.klue.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json; charset=utf-8
  fetched: '2026-08-14'
  file: well-known/klue-openid-configuration.json
- url: https://app.klue.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json; charset=utf-8
  fetched: '2026-08-14'
  file: well-known/klue-oauth-authorization-server.json
  note: byte-identical to the openid-configuration document
related:
  authentication: authentication/klue-authentication.yml
  mcp: mcp/klue-mcp.yml
  well_known: well-known/klue-well-known.yml