Polygon · OAuth Scopes

Polygon OAuth Scopes

OAuth 2.0 searched

Polygon publishes 6 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Polygon API on a user’s behalf.

Tokens are issued from https://auth.massive.com/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

FinanceFintechMarket DataStocksOptionsForexCryptoIndicesFuturesWebSocketsReal-timeHistoricalPublic APIs

Scopes: 6 Flows: authorizationCode, clientCredentials Method: searched

OAuth endpoints

Authorization URL
https://auth.massive.com/oauth2/auth

Token URL
https://auth.massive.com/oauth2/token

Flows
authorizationCodeclientCredentials

Scopes (6)

Scope	Description	Flows
openid	OpenID Connect authentication (standard OIDC scope).
offline_access	Refresh-token issuance for long-lived MCP sessions (standard OIDC scope).
account	Massive account access used by the MCP resource server.
profile	Profile claims (standard OIDC scope; advertised by the authorization server only).
email	Email claim (standard OIDC scope; advertised by the authorization server only).
offline	Legacy alias for offline_access (advertised by the authorization server only).

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-07-22'
method: searched
source: https://mcp.massive.com/.well-known/oauth-protected-resource + https://auth.massive.com/.well-known/openid-configuration
docs: null
notes: >-
  The market-data REST API itself is API-key authenticated and declares no OAuth scopes. This
  scope surface belongs to Massive's hosted remote MCP server (mcp.massive.com), whose RFC 9728
  protected-resource metadata names auth.massive.com as the authorization server. Scope
  descriptions below are the standard OIDC meanings; Massive publishes no per-scope reference page.
schemes:
  - name: OAuth2 (remote MCP server)
    resource: https://mcp.massive.com
    flows:
      - flow: authorizationCode
        authorizationUrl: https://auth.massive.com/oauth2/auth
        tokenUrl: https://auth.massive.com/oauth2/token
      - flow: clientCredentials
        tokenUrl: https://auth.massive.com/oauth2/token
    registration: https://auth.massive.com/oauth2/register
    bearer_methods: [header]
scopes:
  - scope: openid
    description: OpenID Connect authentication (standard OIDC scope).
    sources: [well-known/polygon-oauth-protected-resource.json, well-known/polygon-openid-configuration.json]
  - scope: offline_access
    description: Refresh-token issuance for long-lived MCP sessions (standard OIDC scope).
    sources: [well-known/polygon-oauth-protected-resource.json, well-known/polygon-openid-configuration.json]
  - scope: account
    description: Massive account access used by the MCP resource server.
    sources: [well-known/polygon-oauth-protected-resource.json, well-known/polygon-openid-configuration.json]
  - scope: profile
    description: Profile claims (standard OIDC scope; advertised by the authorization server only).
    sources: [well-known/polygon-openid-configuration.json]
  - scope: email
    description: Email claim (standard OIDC scope; advertised by the authorization server only).
    sources: [well-known/polygon-openid-configuration.json]
  - scope: offline
    description: Legacy alias for offline_access (advertised by the authorization server only).
    sources: [well-known/polygon-openid-configuration.json]