SimilarWeb · OAuth Scopes

SimilarWeb OAuth Scopes

OAuth 2.0 probed

SimilarWeb publishes 1 OAuth 2.0 scope via the authorizationCode flow. Scopes are the fine-grained permissions an application requests at authorization time to act against the SimilarWeb API on a user’s behalf.

Tokens are issued from https://mcp-auth.similarweb.com/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Digital IntelligenceWeb AnalyticsTraffic AnalyticsCompetitive IntelligenceKeyword AnalyticsAudience DemographicsApp IntelligenceMarket ResearchE-CommerceSEO

Scopes: 1 Flows: authorizationCode Method: probed

OAuth endpoints

Authorization URL
https://mcp-auth.similarweb.com/authorize

Token URL
https://mcp-auth.similarweb.com/token

Flows
authorizationCode

Scopes (1)

Scope	Description	Flows
read	Read access to the Similarweb datasets exposed through the MCP server. The only scope advertised by either the protected-resource or the authorization-server metadata.	authorizationCode

📄 Provider scope reference: https://docs.similarweb.com/api-v5/similarweb-mcp/mcp-setup

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://mcp.similarweb.com/.well-known/oauth-protected-resource
description: >-
  Similarweb's REST and Batch APIs have NO OAuth surface — they authenticate with an
  `api-key` header and declare no oauth2 securityScheme in any OpenAPI in this repo
  (derive-oauth-scopes.py found 0 oauth2 schemes across 13 specs). The only OAuth surface
  Similarweb operates is in front of its hosted MCP server, and it is deliberately
  minimal: a single `read` scope covering the whole resource. There is no per-dataset or
  per-endpoint scope model, so an OAuth-issued MCP token is all-or-nothing over whatever
  the underlying subscription entitles. Entitlement, not scope, is what actually bounds
  access at Similarweb — countries, datasets and history windows come from the plan and
  are introspected with the Check Capabilities operation, not from a token claim.

docs: https://docs.similarweb.com/api-v5/similarweb-mcp/mcp-setup

schemes:
- name: MCP OAuth 2.1
  applies_to: https://mcp.similarweb.com
  source: https://mcp-auth.similarweb.com/.well-known/oauth-authorization-server
  issuer: https://mcp-auth.similarweb.com
  flows:
  - flow: authorizationCode
    authorizationUrl: https://mcp-auth.similarweb.com/authorize
    tokenUrl: https://mcp-auth.similarweb.com/token
    refresh: true
    pkce: [S256, plain]
  registration_endpoint: https://mcp-auth.similarweb.com/register
  revocation_endpoint: https://mcp-auth.similarweb.com/revoke
  token_endpoint_auth_methods: [client_secret_post, client_secret_basic, none]

scopes:
- scope: read
  description: >-
    Read access to the Similarweb datasets exposed through the MCP server. The only scope
    advertised by either the protected-resource or the authorization-server metadata.
  flows: [authorizationCode]
  sources:
  - https://mcp.similarweb.com/.well-known/oauth-protected-resource
  - https://mcp-auth.similarweb.com/.well-known/oauth-authorization-server

scope_count: 1

entitlement_model:
  note: >-
    Effective access is bounded by subscription entitlement rather than token scope.
    Callers should introspect it at runtime.
  introspection_operation: checkCapabilities
  introspection_path: /v1/website/{domain_name}/capabilities
  bounded_by: [countries, datasets, historical date range, data-credit balance]
  error_on_out_of_scope: 103 Country not available

x-evidence:
  fetched: '2026-08-13'
  probes:
  - {url: https://mcp.similarweb.com/.well-known/oauth-protected-resource, http_status: 200}
  - {url: https://mcp-auth.similarweb.com/.well-known/oauth-authorization-server, http_status: 200}
  - {url: 'https://mcp-auth.similarweb.com/.well-known/openid-configuration', http_status: 404}