Plex · OAuth Scopes

Plex OAuth Scopes

OAuth 2.0 searched

Plex publishes 7 OAuth 2.0 scopes via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the Plex API on a user’s behalf.

Tokens are issued from https://plex.tv/internal/mcp/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CompanyMediaStreamingVideoMusicMedia ServerEntertainmentSelf-HostedPersonal MediaHome Automation

Scopes: 7 Flows: authorizationCode Method: searched

OAuth endpoints

Authorization URL
https://plex.tv/admin/mcp/authorize

Token URL
https://plex.tv/internal/mcp/oauth/token

Flows
authorizationCode

Scopes (7)

Scope	Description	Flows
mcp	Access to the Plex MCP server at https://plex.tv/internal/mcp.	authorizationCode
username	Include the user's username in the issued Plex JWT.
email	Include the user's email address in the issued Plex JWT.
friendly_name	Include the user's friendly name in the issued Plex JWT.
restricted	Include the user's restricted (managed/child account) status in the issued Plex JWT.
anonymous	Include the user's anonymous status in the issued Plex JWT.
joinedAt	Include the user's account creation timestamp in the issued Plex JWT.

📄 Provider scope reference: https://developer.plex.tv/pms/#section/API-Info/Authenticating-with-Plex

Source

OAuth Scopes

generated: '2026-08-05'
method: searched
source: https://plex.tv/.well-known/oauth-authorization-server
docs: https://developer.plex.tv/pms/#section/API-Info/Authenticating-with-Plex
summary: 'Plex exposes two distinct, unrelated scope vocabularies. The OAuth 2.1 /
  OIDC authorization server published at plex.tv exists only to authorize the Plex
  MCP server and supports exactly one scope. Separately, the device-JWT authentication
  flow used by Plex clients carries a comma-separated "scope" claim naming which
  account attributes are embedded in the issued JWT — these are claim-release scopes,
  not API permissions, and they do not gate any Plex Media Server operation.'
schemes:
- name: plex-mcp-oauth
  kind: oauth2
  source: https://plex.tv/.well-known/oauth-authorization-server
  issuer: https://plex.tv
  flows:
  - flow: authorizationCode
    authorizationUrl: https://plex.tv/admin/mcp/authorize
    tokenUrl: https://plex.tv/internal/mcp/oauth/token
    revocationUrl: https://plex.tv/internal/mcp/oauth/revoke
    registrationUrl: https://plex.tv/internal/mcp/oauth/register
    pkce: S256
- name: plex-device-jwt
  kind: jwt-claim-scope
  source: https://developer.plex.tv/pms/#section/API-Info/Authenticating-with-Plex
  note: The scope field of the device JWT presented to
    POST https://clients.plex.tv/api/v2/auth/token.
scopes:
- scope: mcp
  description: Access to the Plex MCP server at https://plex.tv/internal/mcp.
  schemes:
  - plex-mcp-oauth
  flows:
  - authorizationCode
  sources:
  - https://plex.tv/.well-known/oauth-authorization-server
  - https://plex.tv/.well-known/openid-configuration
  - https://plex.tv/.well-known/oauth-protected-resource
- scope: username
  description: Include the user's username in the issued Plex JWT.
  schemes:
  - plex-device-jwt
- scope: email
  description: Include the user's email address in the issued Plex JWT.
  schemes:
  - plex-device-jwt
- scope: friendly_name
  description: Include the user's friendly name in the issued Plex JWT.
  schemes:
  - plex-device-jwt
- scope: restricted
  description: Include the user's restricted (managed/child account) status in the
    issued Plex JWT.
  schemes:
  - plex-device-jwt
- scope: anonymous
  description: Include the user's anonymous status in the issued Plex JWT.
  schemes:
  - plex-device-jwt
- scope: joinedAt
  description: Include the user's account creation timestamp in the issued Plex JWT.
  schemes:
  - plex-device-jwt
x-notes:
- The Plex Media Server OpenAPI declares a single apiKey security scheme
  (X-Plex-Token header) with no oauth2 flows and therefore no operation-level
  scopes. Authorization on PMS is by token identity and server ownership, not by
  scope.
x-evidence:
- fetched: '2026-08-05'
  url: https://plex.tv/.well-known/oauth-authorization-server
  http_status: 200
- fetched: '2026-08-05'
  url: https://developer.plex.tv/pms/
  http_status: 200