Lithium · OAuth Scopes

Lithium OAuth Scopes

OAuth 2.0 searched

Lithium publishes 1 OAuth 2.0 scope via the clientCredentials and authorizationCode flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Lithium API on a user’s behalf.

Tokens are issued from https://example.com/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyMartechCommunitySocial MediaCustomer EngagementCustomer SupportChatbotsMessagingAnalyticsMarketing

Scopes: 1 Flows: clientCredentials, authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://login.spredfast.com/v3/oauth/authorize

Token URL
https://example.com/oauth2/token https://login.spredfast.com/v3/oauth/token

Flows
clientCredentialsauthorizationCode

Scopes (1)

Scope	Description	Flows
all	Read/write access for all endpoints.	authorizationCode

📄 Provider scope reference: https://developer.khoros.com/khorosmarketingdevdocs/docs/getting-started-with-the-conversations-api

Source

OAuth Scopes

generated: '2026-07-19'
method: searched
source: openapi/lithium-marketing-beta-analytics-api-openapi.json, openapi/lithium-marketing-conversations-api-v1-openapi.json,
  openapi/lithium-marketing-conversations-openapi.json, openapi/lithium-marketing-crm-openapi.json,
  openapi/lithium-marketing-introspection-api-openapi.json, openapi/lithium-marketing-labelsets-api-openapi.json,
  openapi/lithium-marketing-notification-service-openapi.json, openapi/lithium-marketing-stream-api-openapi.json
schemes:
- name: sec0
  source: openapi/lithium-marketing-beta-analytics-api-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://example.com/oauth2/token
- name: oauth2
  source: openapi/lithium-marketing-conversations-api-v1-openapi.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.spredfast.com/v3/oauth/authorize
    tokenUrl: https://login.spredfast.com/v3/oauth/token
- name: sec0
  source: openapi/lithium-marketing-conversations-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://example.com/oauth2/token
- name: sec0
  source: openapi/lithium-marketing-crm-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://example.com/oauth2/token
- name: sec0
  source: openapi/lithium-marketing-introspection-api-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://example.com/oauth2/token
- name: sec0
  source: openapi/lithium-marketing-labelsets-api-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://example.com/oauth2/token
- name: sec0
  source: openapi/lithium-marketing-notification-service-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://example.com/oauth2/token
- name: sec0
  source: openapi/lithium-marketing-stream-api-openapi.json
  flows:
  - flow: clientCredentials
    tokenUrl: https://example.com/oauth2/token
scopes:
- scope: all
  description: Read/write access for all endpoints.
  flows:
  - authorizationCode
  sources:
  - openapi/lithium-marketing-conversations-api-v1-openapi.json

docs: https://developer.khoros.com/khorosmarketingdevdocs/docs/getting-started-with-the-conversations-api
introspection_endpoint: https://api.spredfast.com/v2/whoami
description: >-
  Khoros Marketing is the only product in the Lithium/Khoros surface with an OAuth 2.0
  authorization server, and it publishes a single coarse scope. There is no granular
  read/write or per-resource scope model: `all` grants read/write across every endpoint.
  Access is narrowed by the tenant headers (x-sf-company-id, x-sf-initiative,
  x-sf-user-email) and by the permissions of the authorizing user, not by scope.

scope_model:
  granularity: coarse
  scope_count: 1
  least_privilege_supported: false
  note: >-
    An agent or integration cannot be issued a read-only Khoros Marketing token. Any token
    that works is a read/write token for all endpoints the user can reach.

caveats:
  - >-
    The clientCredentials schemes on seven Marketing definitions carry an empty scopes map
    and the placeholder tokenUrl https://example.com/oauth2/token (a ReadMe API-designer
    default). They are not evidence of a second, scopeless authorization server.
  - >-
    Khoros Care, Khoros Flow and Khoros Community do not use OAuth 2.0 and therefore have
    no scope surface — see ../authentication/lithium-authentication.yml.