MoEngage · OAuth Scopes

MoEngage OAuth Scopes

OAuth 2.0 probed

MoEngage publishes 5 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the MoEngage API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

customer-engagementmarketing-automationcustomer-data-platformpush-notificationsemailsmswhatsappin-app-messagingsegmentationpersonalizationcampaign-managementanalyticsmobile-sdkmcpmartech

Scopes: 5 Flows: Method: probed

Scopes (5)

Scope	Description	Flows
openid	OpenID Connect authentication; issues an ID token identifying the MoEngage user.	authorizationCode
profile	Standard OIDC profile claims for the authenticated MoEngage user.	authorizationCode
email	The authenticated user's MoEngage email address.	authorizationCode
offline_access	Issues a refresh token so the connector can act without re-prompting on every session.	authorizationCode
campaigns:read	Read access to campaigns in the authorized workspace.	authorizationCode

📄 Provider scope reference: https://www.moengage.com/docs/user-guide/ai-and-intelligence/merlin-ai/moengage-mcp-server

Source

OAuth Scopes

generated: '2026-08-01'
method: probed
source: >-
  https://moeauth.moengage.com/.well-known/oauth-authorization-server and
  https://mcp.moengage.com/.well-known/oauth-protected-resource
docs: https://www.moengage.com/docs/user-guide/ai-and-intelligence/merlin-ai/moengage-mcp-server
scope_note: >-
  OAuth exists on the MCP/agent surface only. The 30 REST OpenAPI documents declare HTTP Basic and an
  apiKey header (MOE-APPKEY) and carry no oauth2 securityScheme, so there are no REST scopes to derive.
  Everything below was read from MoEngage's live RFC 8414 / RFC 9728 discovery documents.
schemes:
- name: MoEngage OAuth (MCP)
  issuer: https://moeauth.moengage.com
  authorization_endpoint: https://moeauth.moengage.com/oauth2/authorize
  token_endpoint: https://moeauth.moengage.com/oauth2/token
  userinfo_endpoint: https://moeauth.moengage.com/oauth2/userinfo
  jwks_uri: https://moeauth.moengage.com/.well-known/jwks.json
  registration_endpoint: https://moeauth.moengage.com/oauth2/register
  grant_types:
  - authorization_code
  - client_credentials
  - refresh_token
  - urn:ietf:params:oauth:grant-type:token-exchange
  response_types: [code]
  pkce: [S256]
  token_endpoint_auth_methods: [none, client_secret_post, client_secret_basic]
  id_token_signing_alg: [RS256]
  protected_resource: https://mcp.moengage.com
  source: well-known/moengage-oauth-authorization-server.json
scopes:
- scope: openid
  description: OpenID Connect authentication; issues an ID token identifying the MoEngage user.
  flows: [authorizationCode]
- scope: profile
  description: Standard OIDC profile claims for the authenticated MoEngage user.
  flows: [authorizationCode]
- scope: email
  description: The authenticated user's MoEngage email address.
  flows: [authorizationCode]
- scope: offline_access
  description: Issues a refresh token so the connector can act without re-prompting on every session.
  flows: [authorizationCode]
- scope: campaigns:read
  description: Read access to campaigns in the authorized workspace.
  flows: [authorizationCode]
claims_supported:
- sub
- iss
- aud
- exp
- iat
- email
- name
- dc
- tenant_id
- db_name
- roles
- scope
- client_id
authorization_model_note: >-
  MoEngage documents that the OAuth consent screen may list only a read scope (for example campaigns:read)
  even though the connector exposes write tools. Actual authorization is enforced by the user's MoEngage
  role-based permissions and by which tools the client has enabled, not by the granted scope string. The
  scopes_supported list is therefore narrower than the tool surface it fronts.
tenancy_claims:
  dc: The MoEngage data center the session belongs to.
  tenant_id: The workspace identifier.
  db_name: The backing datastore for the workspace.
  roles: The user's MoEngage roles, which gate tool execution.