Openwork · OAuth Scopes

Openwork OAuth Scopes

OAuth 2.0 searched

Openwork uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyAI AgentsOpen SourceDesktopAgent RuntimeMCPControl PlaneSSOSCIMDeveloper Tools

Scopes: 0 Flows: Method: searched

Scopes (0)

Openwork implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

OAuth 2.0 scopes are advertised via authorization-server / OIDC discovery and gate the OpenWork MCP endpoint (protected resource https://api.openworklabs.com/mcp). The Den REST API itself authenticates with session bearer tokens and organization API keys rather than scoped OAuth tokens.

📄 Provider scope reference: https://openworklabs.com/docs/api-reference

Source

OAuth Scopes

generated: '2026-07-20'
method: searched
source: https://api.openworklabs.com/.well-known/oauth-authorization-server
docs: https://openworklabs.com/docs/api-reference
authorization_server:
  issuer: https://app.openworklabs.com/api/auth
  authorization_endpoint: https://app.openworklabs.com/api/auth/oauth2/authorize
  token_endpoint: https://app.openworklabs.com/api/auth/oauth2/token
  registration_endpoint: https://app.openworklabs.com/api/auth/oauth2/register
  introspection_endpoint: https://app.openworklabs.com/api/auth/oauth2/introspect
  revocation_endpoint: https://app.openworklabs.com/api/auth/oauth2/revoke
  jwks_uri: https://app.openworklabs.com/api/auth/jwks
note: >-
  OAuth 2.0 scopes are advertised via authorization-server / OIDC discovery and
  gate the OpenWork MCP endpoint (protected resource https://api.openworklabs.com/mcp).
  The Den REST API itself authenticates with session bearer tokens and
  organization API keys rather than scoped OAuth tokens.
scopes:
- name: openid
  description: OpenID Connect authentication; issue an ID token for the signed-in user.
- name: profile
  description: Access the user's basic profile claims.
- name: email
  description: Access the user's email address claim.
- name: offline_access
  description: Issue a refresh token for long-lived, offline agent access.
- name: mcp:read
  description: Read access to the OpenWork MCP endpoint (list tools / resources, read state).
- name: mcp:write
  description: Write access to the OpenWork MCP endpoint (invoke tools that mutate state).