Salesforce Service Cloud APIs · OAuth Scopes

Salesforce Service Cloud APIs OAuth Scopes

OAuth 2.0 searched

Salesforce Service Cloud APIs publishes 36 OAuth 2.0 scopes via the authorizationCode and implicit flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Salesforce Service Cloud APIs API on a user’s behalf.

Tokens are issued from https://login.salesforce.com/services/oauth2/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

CloudCRMCustomer ServiceEnterpriseSalesforceSupport

Scopes: 36 Flows: authorizationCode, implicit Method: searched

OAuth endpoints

Authorization URL
https://login.salesforce.com/services/oauth2/authorize

Token URL
https://login.salesforce.com/services/oauth2/token

Flows
authorizationCodeimplicit

Scopes (36)

Scope	Description	Flows
api	Access the Salesforce platform APIs (REST, SOAP, Bulk) as the authenticated user. The scope Service Cloud record work runs on.
mcp_api	Call the Salesforce hosted MCP servers.
chatbot_api	Access bot APIs — the Einstein Bots Runtime API.
refresh_token	Issue a refresh token so the client can obtain new access tokens without re-prompting.
offline_access	OIDC equivalent of refresh_token.
sfap_api	Salesforce AI Platform API access.
einstein_gpt_api	Einstein GPT / generative AI platform API access.
full	Full access to all data the user can access. Broadest scope; avoid for agent clients.
openid	OIDC — issue an ID token.
id	Access the identity URL service.
profile
email
address
phone
web	Access to the web UI via the access token.
lightning	Access Lightning applications.
visualforce	Access Visualforce pages.
content	Access Salesforce CRM Content.
chatter_api	Access the Connect REST API (Chatter/Connect).
custom_permissions	Return the custom permissions in the org associated with the connected app.
interaction_api	Interaction Studio / personalization API.
wave_api	CRM Analytics (Wave/Tableau CRM) REST API.
eclair_api	CRM Analytics Eclair chart API.
pardot_api	Account Engagement (Pardot) API.
scrt_api	Service Cloud Real-Time (SCRT) — the Messaging for In-App and Web transport.
user_registration_api
pwdless_login_api	Passwordless login API.
forgot_password
cdp_api	Data Cloud / CDP API.
cdp_ingest_api
cdp_query_api
cdp_profile_api
cdp_segment_api
cdp_identityresolution_api
cdp_calculated_insight_api
data_cloud_user_claims

📄 Provider scope reference: https://help.salesforce.com/s/articleView?id=platform.remoteaccess_oauth_tokens_scopes.htm&type=5

Source

OAuth Scopes

generated: '2026-08-27'
method: searched
source: >-
  https://login.salesforce.com/.well-known/openid-configuration (probed 200, 2026-08-27 — saved to
  well-known/service-cloud-login-openid-configuration.json),
  https://api.salesforce.com/.well-known/oauth-authorization-server (probed 200),
  https://api.salesforce.com/.well-known/oauth-protected-resource/platform/mcp/v1/platform/sobject-all (probed 200),
  and openapi/service-cloud-einstein-bots-openapi.yml
docs: https://help.salesforce.com/s/articleView?id=platform.remoteaccess_oauth_tokens_scopes.htm&type=5
note: >-
  The scope list is READ FROM THE PROVIDER'S OWN DISCOVERY DOCUMENTS, not from prose. Two documents
  disagree: login.salesforce.com/.well-known/openid-configuration advertises 37 scopes; the
  api.salesforce.com authorization-server document advertises only 4. Both are recorded.
schemes:
  - name: chatbotAuth
    type: oauth2
    source: openapi/service-cloud-einstein-bots-openapi.yml
    flows:
      - flow: authorizationCode
        authorizationUrl: https://login.salesforce.com/services/oauth2/authorize
        tokenUrl: https://login.salesforce.com/services/oauth2/token
      - flow: implicit
        authorizationUrl: https://login.salesforce.com/services/oauth2/authorize
    description: chatbotAuth supports authorization code and implicit OAuth flows.
  - name: jwtBearer
    type: http
    scheme: bearer
    source: openapi/service-cloud-einstein-bots-openapi.yml
    description: >-
      Salesforce OAuth access token obtained using the JWT Bearer flow. Use the chatbot_api scope
      with this flow to enable access to the Einstein Bots services.
scopes:
  - scope: api
    description: Access the Salesforce platform APIs (REST, SOAP, Bulk) as the authenticated user. The scope Service Cloud record work runs on.
    advertised_by: [login.salesforce.com, api.salesforce.com]
  - scope: mcp_api
    description: Call the Salesforce hosted MCP servers.
    advertised_by: [login.salesforce.com, 'api.salesforce.com (per-resource metadata for /platform/mcp/v1/platform/sobject-all)']
  - scope: chatbot_api
    description: Access bot APIs — the Einstein Bots Runtime API.
    advertised_by: [login.salesforce.com, 'openapi/service-cloud-einstein-bots-openapi.yml']
  - scope: refresh_token
    description: Issue a refresh token so the client can obtain new access tokens without re-prompting.
    advertised_by: [login.salesforce.com, api.salesforce.com, 'api.salesforce.com per-resource metadata']
  - scope: offline_access
    description: OIDC equivalent of refresh_token.
    advertised_by: [login.salesforce.com]
  - scope: sfap_api
    description: Salesforce AI Platform API access.
    advertised_by: [login.salesforce.com, api.salesforce.com]
  - scope: einstein_gpt_api
    description: Einstein GPT / generative AI platform API access.
    advertised_by: [login.salesforce.com, api.salesforce.com]
  - scope: full
    description: Full access to all data the user can access. Broadest scope; avoid for agent clients.
    advertised_by: [login.salesforce.com]
  - scope: openid
    description: OIDC — issue an ID token.
    advertised_by: [login.salesforce.com]
  - scope: id
    description: Access the identity URL service.
    advertised_by: [login.salesforce.com]
  - scope: profile
    advertised_by: [login.salesforce.com]
  - scope: email
    advertised_by: [login.salesforce.com]
  - scope: address
    advertised_by: [login.salesforce.com]
  - scope: phone
    advertised_by: [login.salesforce.com]
  - scope: web
    description: Access to the web UI via the access token.
    advertised_by: [login.salesforce.com]
  - scope: lightning
    description: Access Lightning applications.
    advertised_by: [login.salesforce.com]
  - scope: visualforce
    description: Access Visualforce pages.
    advertised_by: [login.salesforce.com]
  - scope: content
    description: Access Salesforce CRM Content.
    advertised_by: [login.salesforce.com]
  - scope: chatter_api
    description: Access the Connect REST API (Chatter/Connect).
    advertised_by: [login.salesforce.com]
  - scope: custom_permissions
    description: Return the custom permissions in the org associated with the connected app.
    advertised_by: [login.salesforce.com]
  - scope: interaction_api
    description: Interaction Studio / personalization API.
    advertised_by: [login.salesforce.com]
  - scope: wave_api
    description: CRM Analytics (Wave/Tableau CRM) REST API.
    advertised_by: [login.salesforce.com]
  - scope: eclair_api
    description: CRM Analytics Eclair chart API.
    advertised_by: [login.salesforce.com]
  - scope: pardot_api
    description: Account Engagement (Pardot) API.
    advertised_by: [login.salesforce.com]
  - scope: scrt_api
    description: Service Cloud Real-Time (SCRT) — the Messaging for In-App and Web transport.
    advertised_by: [login.salesforce.com]
    note: The most Service-Cloud-specific scope in the list.
  - scope: user_registration_api
    advertised_by: [login.salesforce.com]
  - scope: pwdless_login_api
    description: Passwordless login API.
    advertised_by: [login.salesforce.com]
  - scope: forgot_password
    advertised_by: [login.salesforce.com]
  - scope: cdp_api
    description: Data Cloud / CDP API.
    advertised_by: [login.salesforce.com]
  - scope: cdp_ingest_api
    advertised_by: [login.salesforce.com]
  - scope: cdp_query_api
    advertised_by: [login.salesforce.com]
  - scope: cdp_profile_api
    advertised_by: [login.salesforce.com]
  - scope: cdp_segment_api
    advertised_by: [login.salesforce.com]
  - scope: cdp_identityresolution_api
    advertised_by: [login.salesforce.com]
  - scope: cdp_calculated_insight_api
    advertised_by: [login.salesforce.com]
  - scope: data_cloud_user_claims
    advertised_by: [login.salesforce.com]
scope_count: 36
least_privilege:
  note: >-
    Scopes are coarse. `api` grants everything the authenticated USER can reach — there is no
    read-only or Case-only scope. Fine-grained restriction is enforced by the org's profile,
    permission set and sharing rules on that user, not by the token. For agents, the practical
    least-privilege lever is choosing the narrow hosted MCP server (sobject-reads or
    sobject-mutations instead of sobject-all) and a purpose-built integration user.

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this

find_scopesBrowse and filter every scope set in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This scope set

curl "https://apis.io/api/v1/scopes/service-cloud-scopes"

All oauth scopes

curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.