| Scope | Purpose |
|---|---|
| openid | OIDC identity semantics where requested. |
| profile | Scoped profile claims. |
| Scoped email claims. | |
| offline_access | Refresh-token behavior where issued. |
| identity.api_keys.create | MCP-only authorization to create explicitly requested, read-only API keys; this scope is not available on ordinary API keys. |
| identity.profile.read | Read profile fields. |
| identity.profile.write | Update display name, locale, or IANA timezone. |
| identity.email.read | Read primary email and verification state. |
| identity.privacy.export | Export the authenticated user's server-backed data boundary without secrets. |
| identity.organization.read | Read organization context available to the token. |
| identity.organization.members.read | Read permitted organization members. |
| identity.permissions.read | Read permitted authorization context. |
| identity.sessions.read | Read permitted session context. |
The server may return insufficient_scope when a bearer token lacks the required scope. Do not treat a requested scope as a grant; enforce the response and consent result.