StackAdapt · OAuth Scopes

StackAdapt OAuth Scopes

OAuth 2.0 probed

StackAdapt publishes 2 OAuth 2.0 scopes via the authorizationCode and clientCredentials flows. Scopes are the fine-grained permissions an application requests at authorization time to act against the StackAdapt API on a user’s behalf.

Tokens are issued from https://www.stackadapt.com/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Programmatic AdvertisingDigital AdvertisingCampaign ManagementAd TechDSPDemand-Side PlatformNative AdvertisingDisplay AdvertisingVideo AdvertisingConnected TVAudience TargetingReal-Time BiddingConversion TrackingPerformance Reporting

Scopes: 2 Flows: authorizationCode, clientCredentials Method: probed

OAuth endpoints

Authorization URL
https://www.stackadapt.com/oauth/authorize

Token URL
https://www.stackadapt.com/oauth/token

Flows
authorizationCodeclientCredentials

Scopes (2)

Scope	Description	Flows
graphql-public:read	Read access to the StackAdapt GraphQL Public API surface via the MCP resource.	authorizationCode, clientCredentials
graphql-public:write	Write access to the StackAdapt GraphQL Public API surface via the MCP resource.	authorizationCode, clientCredentials

📄 Provider scope reference:

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: >-
  https://mcp.stackadapt.com/.well-known/oauth-protected-resource (RFC 9728) and
  https://api.stackadapt.com/.well-known/oauth-authorization-server (RFC 8414)
docs: null
note: >-
  StackAdapt publishes no OpenAPI, so these scopes are NOT derived from a spec — they are read
  verbatim from the two machine-readable OAuth discovery documents StackAdapt serves. No public
  scopes/permissions reference page exists: docs.stackadapt.com disallows all crawlers in its
  robots.txt, so the descriptions below are inferred from the scope names and their resource,
  not quoted from StackAdapt documentation. Treat the descriptions as ours and the scope
  strings as theirs.

schemes:
- name: MCPOAuth
  source: https://mcp.stackadapt.com/.well-known/oauth-protected-resource
  resource: https://mcp.stackadapt.com/
  authorization_server: https://www.stackadapt.com/
  flows:
  - flow: authorizationCode
    authorizationUrl: https://www.stackadapt.com/oauth/authorize
    tokenUrl: https://www.stackadapt.com/oauth/token
  - flow: clientCredentials
    tokenUrl: https://www.stackadapt.com/oauth/token
  code_challenge_methods: [S256, plain]
  dynamic_client_registration: https://www.stackadapt.com/oauth/register

scopes:
- scope: graphql-public:read
  description: Read access to the StackAdapt GraphQL Public API surface via the MCP resource.
  flows: [authorizationCode, clientCredentials]
  sources:
  - https://mcp.stackadapt.com/.well-known/oauth-protected-resource
  - https://api.stackadapt.com/.well-known/oauth-authorization-server
  description_provenance: inferred-from-scope-name
- scope: graphql-public:write
  description: Write access to the StackAdapt GraphQL Public API surface via the MCP resource.
  flows: [authorizationCode, clientCredentials]
  sources:
  - https://mcp.stackadapt.com/.well-known/oauth-protected-resource
  description_provenance: inferred-from-scope-name
  note: >-
    Advertised by the MCP protected-resource metadata but NOT by the authorization server
    metadata, whose scopes_supported lists only graphql-public:read. The two documents
    disagree; a client should expect the authorization server to be the binding constraint.

divergence:
  authorization_server_scopes_supported: [graphql-public:read]
  protected_resource_scopes_supported: [graphql-public:read, graphql-public:write]
  note: >-
    Recorded as observed. This is a real inconsistency between StackAdapt's RFC 8414 and
    RFC 9728 documents, not a harvesting artefact — both were fetched anonymously on
    2026-08-13 and both returned 200.

summary:
  scope_count: 2
  granularity: coarse
  note: >-
    Two scopes cover the entire GraphQL surface (55 root queries and 97 root mutations in
    graphql/stackadapt-schema.graphql). There is no per-resource or per-product scoping, so a
    read token sees every campaign, advertiser, segment and pixel the account can reach.