Yoast · OAuth Scopes

Yoast OAuth Scopes

OAuth 2.0 probed

Yoast uses OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (e.g. client-credentials or role-based authorization) rather than per-scope consent.

Tokens are issued from https://my.yoast.com/api/oauth/token.

This index is generated from the provider’s OpenAPI security definitions (and, where available, its documented scope reference) and refreshes on every APIs.io network build. Browse every provider’s scopes at scopes.apis.io.

SEOWordPressContent OptimizationSchemaMetadataStructured DataHeadless CMSContent AnalysisAgent ReadinessPlugins

Scopes: 0 Flows: authorizationCode, clientCredentials, refreshToken Method: probed

OAuth endpoints

Authorization URL
https://my.yoast.com/api/oauth/auth

Token URL
https://my.yoast.com/api/oauth/token

Flows
authorizationCodeclientCredentialsrefreshToken

Scopes (0)

Yoast implements OAuth 2.0 but publishes no discrete scopes — access is governed by the grant itself (client-credentials or role-based authorization) rather than per-scope consent.

derive-oauth-scopes.py found no oauth2 securityScheme in any OpenAPI in this repo, and that is correct — the MyYoast Provisioning API is Basic Auth. The scopes below are NOT derived from a spec; they were read live from the MyYoast OpenID Connect discovery document at https://my.yoast.com/.well-known/openid-configuration (HTTP 200, application/json). They are the standard OIDC scope set: MyYoast issues identity tokens for the Yoast SEO plugin's site/user authentication, and publishes no product-specific scopes (nothing like seo:read or subscriptions:write). An integrator cannot request granular Yoast permissions, because none are advertised.

📄 Provider scope reference: https://developer.yoast.com/features/wp-cli/auth/

Source

OAuth Scopes

generated: '2026-08-13'
method: probed
source: https://my.yoast.com/.well-known/openid-configuration
docs: https://developer.yoast.com/features/wp-cli/auth/
note: >-
  derive-oauth-scopes.py found no oauth2 securityScheme in any OpenAPI in this repo, and
  that is correct — the MyYoast Provisioning API is Basic Auth. The scopes below are NOT
  derived from a spec; they were read live from the MyYoast OpenID Connect discovery
  document at https://my.yoast.com/.well-known/openid-configuration (HTTP 200,
  application/json). They are the standard OIDC scope set: MyYoast issues identity
  tokens for the Yoast SEO plugin's site/user authentication, and publishes no
  product-specific scopes (nothing like seo:read or subscriptions:write). An integrator
  cannot request granular Yoast permissions, because none are advertised.
issuer: https://my.yoast.com
schemes:
  - name: MyYoast OpenID Connect
    type: openIdConnect
    source: well-known/yoast-openid-configuration.json
    flows:
      - flow: authorizationCode
        authorizationUrl: https://my.yoast.com/api/oauth/auth
        tokenUrl: https://my.yoast.com/api/oauth/token
        pkce: S256
      - flow: clientCredentials
        tokenUrl: https://my.yoast.com/api/oauth/token
      - flow: refreshToken
        tokenUrl: https://my.yoast.com/api/oauth/token
scopes:
  - name: openid
    description: Standard OIDC scope; requests an ID token identifying the subject.
    standard: true
  - name: profile
    description: Standard OIDC scope; basic profile claims.
    standard: true
  - name: email
    description: Standard OIDC scope; email claims.
    standard: true
  - name: phone
    description: Standard OIDC scope; phone claims.
    standard: true
  - name: address
    description: Standard OIDC scope; address claims.
    standard: true
  - name: offline_access
    description: Standard OIDC scope; requests a refresh token for long-lived access.
    standard: true
claims_supported:
  - sub
  - sid
  - auth_time
  - iss
scope_count: 6
product_specific_scope_count: 0
gaps:
  - >-
    Every advertised scope is a standard OIDC scope. MyYoast publishes no
    product-permission scopes, so an authorized client's actual authority over Yoast
    resources is not expressible or inspectable through the scope model.
x-evidence:
  fetched: '2026-08-13'
  url: https://my.yoast.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json; charset=utf-8