Spocket · OAuth Scopes

Spocket OAuth Scopes

OAuth 2.0 searched

Spocket publishes 5 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the Spocket API on a user’s behalf.

Tokens are issued from https://www.spocket.dev/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

PaaSapplication-hostingbot-hostingdeveloper-toolsagent-infrastructureMCPdeploymentserverlessalways-on

Scopes: 5 Flows: authorizationCode, clientCredentials Method: searched

OAuth endpoints

Authorization URL
https://www.spocket.dev/oauth/authorize

Token URL
https://www.spocket.dev/oauth/token https://www.spocket.dev/api/v1/token

Flows
authorizationCodeclientCredentials

Scopes (5)

Scope	Description	Flows
spocket	The single coarse scope advertised by the MCP authorization server. All 20 MCP tools are covered by it - the provider states no plan or tier gates a tool, and no per-tool or read-only variant is published.	authorizationCode
apps:read	List apps, read status and logs.	clientCredentials
apps:write	Provision, deploy, start, stop, restart.	clientCredentials
apps:delete	Delete apps.	clientCredentials
domains:write	Attach and verify custom domains.	clientCredentials

📄 Provider scope reference: https://www.spocket.dev/documentation/platform-api

Source

OAuth Scopes

generated: '2026-08-09'
method: searched
source: https://www.spocket.dev/documentation/platform-api
docs: https://www.spocket.dev/documentation/platform-api
note: >-
  Two independent OAuth surfaces with two independent scope vocabularies. The MCP scope
  set comes from the live RFC 8414 authorization-server metadata; the Platform API scope
  set comes from the provider's published scope table. Spocket publishes no OpenAPI, so
  derive-oauth-scopes.py has no securitySchemes to read - these are searched, not derived.
schemes:
  - name: MCPOAuth21
    source: well-known/spocket-oauth-authorization-server.json
    surface: https://www.spocket.dev/api/mcp
    flows:
      - flow: authorizationCode
        authorizationUrl: https://www.spocket.dev/oauth/authorize
        tokenUrl: https://www.spocket.dev/oauth/token
        code_challenge_methods_supported: [S256]
  - name: PlatformClientCredentials
    source: 'https://www.spocket.dev/documentation/platform-api'
    surface: https://www.spocket.dev/api/v1
    flows:
      - flow: clientCredentials
        tokenUrl: https://www.spocket.dev/api/v1/token
scopes:
  - scope: spocket
    description: >-
      The single coarse scope advertised by the MCP authorization server. All 20 MCP tools
      are covered by it - the provider states no plan or tier gates a tool, and no
      per-tool or read-only variant is published.
    flows: [authorizationCode]
    surface: mcp
    sources: [well-known/spocket-oauth-authorization-server.json]
  - scope: apps:read
    description: List apps, read status and logs.
    flows: [clientCredentials]
    surface: platform-rest
    sources: ['https://www.spocket.dev/documentation/platform-api']
  - scope: apps:write
    description: Provision, deploy, start, stop, restart.
    flows: [clientCredentials]
    surface: platform-rest
    sources: ['https://www.spocket.dev/documentation/platform-api']
  - scope: apps:delete
    description: Delete apps.
    flows: [clientCredentials]
    surface: platform-rest
    sources: ['https://www.spocket.dev/documentation/platform-api']
  - scope: domains:write
    description: Attach and verify custom domains.
    flows: [clientCredentials]
    surface: platform-rest
    sources: ['https://www.spocket.dev/documentation/platform-api']
observations:
  - >-
    domains:write is a published scope with no corresponding endpoint in the published
    Platform API endpoint table - the capability is scoped but not documented.
  - >-
    The MCP surface has one scope covering every tool including the destructive
    spocket_delete, so an MCP consent grant cannot be narrowed the way a Platform API key
    can be at creation.
x-evidence:
  fetched: '2026-08-09'
  probed:
    - url: https://www.spocket.dev/.well-known/oauth-authorization-server
      status: 200
    - url: https://www.spocket.dev/documentation/platform-api
      status: 200