Toast · OAuth Scopes

Toast OAuth Scopes

OAuth 2.0 searched

Toast publishes 28 OAuth 2.0 scopes. Scopes are the fine-grained permissions an application requests at authorization time to act against the Toast API on a user’s behalf.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

Food ServicePoint-of-SaleRestaurantHospitality
Scopes: 28 Flows: Method: searched

Scopes (28)

ScopeDescriptionFlows
cashmgmt:read Allows reading from the cash management API. clientCredentials
config:read Allows reading from the configuration API. clientCredentials
credit_cards.authorization:write Allows authorization of payments through the credit cards API. clientCredentials
device-details.info:read Allows reading from the device details API. clientCredentials
kitchen:read Allows reading from the kitchen API. clientCredentials
labor:read Allows reading all data except employees from the labor API. clientCredentials
labor.employees:read Allows reading employee information from the labor API. clientCredentials
labor.employees:write Allows updating employee information in the labor API. clientCredentials
labor.jobs:write Allows updating job information in the labor API. clientCredentials
labor.shifts:write Allows updating shift information in the labor API. clientCredentials
menus.channel:read Allows reading from the menus API V3. Ordering partner integrations must use V3, which requires this scope. clientCredentials
menus:read Allows reading from the menus API V2. Because V3 currently only supports ordering partner integrations, all other integration partners continue to use V2 with this scope. clientCredentials
digital_schedule:read Allows reading from the order management configuration API. clientCredentials
orders:read Allows reading from the orders API with the exception of guest information. If the API client creates orders, it must have BOTH orders:read and orders.channel:read to read them back. clientCredentials
orders.channel:read Allows API clients that submit orders to read from the orders API. Must be held together with orders:read. Clients with this scope can only read the orders they themselves created. clientCredentials
delivery_info.address:read Allows reading guest delivery address information from the orders API. clientCredentials
guest.pi:read Allows reading guest and curbside pickup information from the orders API. This is the scope that gates guest personal information. clientCredentials
orders.delivery_info:write Allows updating delivery information through the orders API. clientCredentials
orders.discounts:write Allows adding discounts to orders using the orders API. clientCredentials
orders.items:write Allows adding items to orders using the orders API. clientCredentials
orders.orders:write Allows posting orders using the orders API. clientCredentials
orders.payments:write Allows adding payments and tips to existing orders using the orders API. clientCredentials
orders.channel:void Allows voiding an order using the orders API. This is the only reversal scope Toast publishes. clientCredentials
packaging:read Allows reading a restaurant's packaging preferences configuration using the packaging configuration API. clientCredentials
restaurants:read Allows reading from the restaurant availability API and from the restaurants API. clientCredentials
stock:read Allows reading from the stock API. clientCredentials
stock:write Allows updating stock status for menu items and modifier option item references using the stock API. clientCredentials
enterprise-metrics:read Allows reading from the analytics API. Declared in the analytics OpenAPI securityScheme; not listed in the developer guide scope table, which covers the partner/custom integration scopes. clientCredentials

📄 Provider scope reference: https://doc.toasttab.com/doc/devguide/apiScopes.htmlhttps://doc.toasttab.com/doc/devguide/authentication.htmlhttps://doc.toasttab.com/doc/devguide/apiOrdersGetScopes.htmlhttps://doc.toasttab.com/doc/devguide/devApiAccessScopes.html

Source

OAuth Scopes

Raw ↑ 
generated: '2026-08-27'
method: searched
source: https://doc.toasttab.com/doc/devguide/apiScopes.html
docs:
- https://doc.toasttab.com/doc/devguide/apiScopes.html
- https://doc.toasttab.com/doc/devguide/authentication.html
- https://doc.toasttab.com/doc/devguide/apiOrdersGetScopes.html
- https://doc.toasttab.com/doc/devguide/devApiAccessScopes.html
provider: Toast
providerId: toast
summary: 'Toast publishes a complete scope reference in its developer guide - 26 named scopes across 12
  API areas, each labelled Read, Write or Void. Scopes are attached to the API CLIENT ACCOUNT, not requested
  per call: there is no scope parameter on the token request. The granted scopes are encoded inside the
  returned JWT, so a client discovers its own permissions by decoding the token it was issued. Only 10
  of the 26 appear in the securitySchemes of the published OpenAPI definitions, so the docs table - not
  the contract - is the authoritative list.'
authorization_model:
  flow: clientCredentials
  token_endpoint: POST /authentication/v1/authentication/login
  scope_request_parameter: false
  note: Scopes are provisioned onto the API client account by Toast (or by the customer in Toast Web for
    Standard API access). The token response carries them inside the JWT; decode the token to see what
    the client actually holds.
  discovery: https://doc.toasttab.com/doc/devguide/apiAuthenticatingRequestsFromToastApiClients.html
scope_count: 28
documented_in_guide: 27
declared_in_spec: 10
scopes:
- scope: cashmgmt:read
  api: Cash management
  type: read
  description: Allows reading from the cash management API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-cash-management-openapi.yaml
  provenance: docs+spec
- scope: config:read
  api: Configuration
  type: read
  description: Allows reading from the configuration API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-configuration-openapi.yaml
  provenance: docs+spec
- scope: credit_cards.authorization:write
  api: Credit cards
  type: write
  description: Allows authorization of payments through the credit cards API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-credit-cards-openapi.yaml
  provenance: docs+spec
- scope: device-details.info:read
  api: Device details
  type: read
  description: Allows reading from the device details API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-device-details-openapi.yaml
  provenance: docs+spec
- scope: kitchen:read
  api: Kitchen
  type: read
  description: Allows reading from the kitchen API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-kitchen-openapi.yaml
  provenance: docs+spec
- scope: labor:read
  api: Labor
  type: read
  description: Allows reading all data except employees from the labor API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-shifts-api-openapi.yml
  - openapi/toast-jobs-api-openapi.yml
  - openapi/toast-time-entries-api-openapi.yml
  provenance: docs+spec
- scope: labor.employees:read
  api: Labor
  type: read
  description: Allows reading employee information from the labor API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-employees-api-openapi.yml
  provenance: docs+spec
- scope: labor.employees:write
  api: Labor
  type: write
  description: Allows updating employee information in the labor API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-employees-api-openapi.yml
  provenance: docs+spec
- scope: labor.jobs:write
  api: Labor
  type: write
  description: Allows updating job information in the labor API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-jobs-api-openapi.yml
  provenance: docs+spec
- scope: labor.shifts:write
  api: Labor
  type: write
  description: Allows updating shift information in the labor API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-shifts-api-openapi.yml
  provenance: docs+spec
- scope: menus.channel:read
  api: Menus
  type: read
  description: Allows reading from the menus API V3. Ordering partner integrations must use V3, which
    requires this scope.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-menus-v3-openapi.yaml
  provenance: docs+spec
- scope: menus:read
  api: Menus
  type: read
  description: Allows reading from the menus API V2. Because V3 currently only supports ordering partner
    integrations, all other integration partners continue to use V2 with this scope.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-menus-api-openapi.yml
  - openapi/toast-metadata-api-openapi.yml
  provenance: docs+spec
- scope: digital_schedule:read
  api: Order management configuration
  type: read
  description: Allows reading from the order management configuration API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-ordermgmt-configuration-openapi.yaml
  provenance: docs+spec
- scope: orders:read
  api: Orders
  type: read
  description: Allows reading from the orders API with the exception of guest information. If the API
    client creates orders, it must have BOTH orders:read and orders.channel:read to read them back.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-orders-api-openapi.yml
  provenance: docs+spec
- scope: orders.channel:read
  api: Orders
  type: read
  description: Allows API clients that submit orders to read from the orders API. Must be held together
    with orders:read. Clients with this scope can only read the orders they themselves created.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-orders-api-openapi.yml
  provenance: docs+spec
- scope: delivery_info.address:read
  api: Orders
  type: read
  description: Allows reading guest delivery address information from the orders API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-orders-api-openapi.yml
  provenance: docs+spec
- scope: guest.pi:read
  api: Orders
  type: read
  description: Allows reading guest and curbside pickup information from the orders API. This is the scope
    that gates guest personal information.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-orders-api-openapi.yml
  provenance: docs+spec
- scope: orders.delivery_info:write
  api: Orders
  type: write
  description: Allows updating delivery information through the orders API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-orders-api-openapi.yml
  provenance: docs+spec
- scope: orders.discounts:write
  api: Orders
  type: write
  description: Allows adding discounts to orders using the orders API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-discounts-api-openapi.yml
  provenance: docs+spec
- scope: orders.items:write
  api: Orders
  type: write
  description: Allows adding items to orders using the orders API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-orders-api-openapi.yml
  provenance: docs+spec
- scope: orders.orders:write
  api: Orders
  type: write
  description: Allows posting orders using the orders API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-orders-api-openapi.yml
  provenance: docs+spec
- scope: orders.payments:write
  api: Orders
  type: write
  description: Allows adding payments and tips to existing orders using the orders API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-payments-api-openapi.yml
  provenance: docs+spec
- scope: orders.channel:void
  api: Orders
  type: void
  description: Allows voiding an order using the orders API. This is the only reversal scope Toast publishes.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-orders-api-openapi.yml
  provenance: docs+spec
- scope: packaging:read
  api: Packaging preferences
  type: read
  description: Allows reading a restaurant's packaging preferences configuration using the packaging configuration
    API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-packaging-openapi.yaml
  provenance: docs+spec
- scope: restaurants:read
  api: Restaurant availability / Restaurants
  type: read
  description: Allows reading from the restaurant availability API and from the restaurants API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-restaurants-api-openapi.yml
  - openapi/toast-restaurant-availability-openapi.yaml
  provenance: docs+spec
- scope: stock:read
  api: Stock
  type: read
  description: Allows reading from the stock API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-stock-api-openapi.yml
  provenance: docs+spec
- scope: stock:write
  api: Stock
  type: write
  description: Allows updating stock status for menu items and modifier option item references using the
    stock API.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-stock-api-openapi.yml
  provenance: docs+spec
- scope: enterprise-metrics:read
  api: Analytics
  type: read
  description: Allows reading from the analytics API. Declared in the analytics OpenAPI securityScheme;
    not listed in the developer guide scope table, which covers the partner/custom integration scopes.
  flows:
  - clientCredentials
  sources:
  - openapi/toast-analytics-openapi.yaml
  provenance: spec-only
compound_requirements:
- operation: read orders you created
  requires:
  - orders:read
  - orders.channel:read
  note: An order-submitting client needs BOTH scopes; with orders.channel:read alone it can only read
    its own orders.
- operation: read guest personal information on an order
  requires:
  - orders:read
  - guest.pi:read
  note: orders:read explicitly excludes guest information; guest.pi:read is the separate gate.
- operation: read a delivery address
  requires:
  - orders:read
  - delivery_info.address:read
- operation: void an order
  requires:
  - orders.channel:void
  note: Also requires that the SAME clientId created the order. See conventions/toast-conventions.yml
    reversibility.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Work with this as data

Every scope set here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for oauth scopes

4 MCP tools reach this
  • find_scopesBrowse and filter every scope set in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This scope set 
curl "https://apis.io/api/v1/scopes/toast-scopes"
All oauth scopes 
curl "https://apis.io/api/v1/scopes?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.