Klutch · OAuth Scopes

Klutch OAuth Scopes

OAuth 2.0 searched

Klutch publishes 4 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Klutch API on a user’s behalf.

Tokens are issued from https://graphql.klutchcard.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyFinancial ServicesFintechCredit CardsPaymentsCard IssuingVirtual CardsTransactionsSpend ManagementPersonal FinanceGraphQLEmbedded FinanceAgents

Scopes: 4 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://graphql.klutchcard.com/oauth/authorize

Token URL
https://graphql.klutchcard.com/oauth/token

Flows
authorizationCode

Scopes (4)

Scope	Description	Flows
openid	OpenID Connect subject identifier; required to obtain an ID token.	authorizationCode
email	The user's email address claim.	authorizationCode
phone	The user's phone number claim.	authorizationCode
profile	The user's basic profile claims.	authorizationCode

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-07-19'
method: searched
source: well-known/klutch-graphql-oauth-authorization-server.json,
  well-known/klutch-mcp-oauth-protected-resource.json
docs: null
docs_note: >-
  Klutch does not publish a scopes / permissions reference page. The scope list below
  is taken verbatim from the live RFC 8414 authorization-server metadata on all three
  hosts and the RFC 9728 protected-resource metadata on the MCP server, which agree.
  These are the standard OpenID Connect identity scopes — Klutch does not expose
  resource-level (cards / transactions / rules) scopes over OAuth. Fine-grained access
  is instead governed by the Mini App permission model, where the installing user
  grants a Mini App the ability to create cards, read transactions and create spending
  controls.
schemes:
- name: oauth2
  source: well-known/klutch-graphql-oauth-authorization-server.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://graphql.klutchcard.com/oauth/authorize
    tokenUrl: https://graphql.klutchcard.com/oauth/token
    code_challenge_methods_supported: [S256]
scopes:
- scope: openid
  description: OpenID Connect subject identifier; required to obtain an ID token.
  flows: [authorizationCode]
  sources: [well-known/klutch-graphql-oauth-authorization-server.json, well-known/klutch-mcp-oauth-protected-resource.json]
- scope: email
  description: The user's email address claim.
  flows: [authorizationCode]
  sources: [well-known/klutch-graphql-oauth-authorization-server.json, well-known/klutch-mcp-oauth-protected-resource.json]
- scope: phone
  description: The user's phone number claim.
  flows: [authorizationCode]
  sources: [well-known/klutch-graphql-oauth-authorization-server.json, well-known/klutch-mcp-oauth-protected-resource.json]
- scope: profile
  description: The user's basic profile claims.
  flows: [authorizationCode]
  sources: [well-known/klutch-graphql-oauth-authorization-server.json, well-known/klutch-mcp-oauth-protected-resource.json]
miniapp_permissions:
  model: >-
    Documented in the Klutch Public API collection as the "Miniapp Developer" mode:
    a registered Mini App authenticates on behalf of a user and, once authorized by
    that user, may act in their context.
  granted_capabilities:
  - Create cards on behalf of users
  - Read transactions
  - Create spending controls
  source: postman/klutch-public-api-postman.json