Scoped OAuth access
Restrict connectors below full account access.
OAuth supports a base access mode plus optional resource restrictions.
| Scope | Effect |
|---|---|
mcp |
Discover, execute and read results within the account's existing access |
mcp:read |
Discover and read results; cannot execute or spend credits |
mcp:account:read |
Read account-wide balance, usage totals and execution limits |
mcp:feedback:read |
Read feedback from this application |
mcp:feedback:write |
Send bounded feedback; also requires mcp |
platform:amazon |
Restrict the base access mode to this platform |
capability:amazon.products.search |
Restrict the base access mode to this capability |
Use exactly one base mode. Space-separated platform restrictions form an allowlist;
capability restrictions form another allowlist. When both exist, a request must
satisfy both. Restrictions never add account privileges or reveal private capabilities.
For example, mcp:read platform:amazon permits reading Amazon jobs but no execution.
The consent page can narrow a requested grant to one platform and/or read-only
access. Token refresh preserves the resulting grant; it cannot broaden it.
Legacy mcp grants retain their existing behavior until revoked or replaced.
Result access includes other applications' jobs within the permitted account and
resources. A tool profile or pinning URL controls presentation, not permissions.
Feature access must be explicitly requested and consented to. Existing base grants do not acquire it automatically. Read-only consent removes feedback-write access. Account aggregates include other applications even with a platform restriction.
Managed MCP collections require explicit collections:read / collections:write API-key permissions or mcp:collections:read / mcp:collections:write OAuth scopes. Reads also require jobs:read; writes require execution access. The normal MCP URL lists these tools when permitted. Select additional access during OAuth consent even if the client did not request feature scopes. Existing stored grants gain no permissions. Account and resource restrictions apply on every handle and record page.
Credit prices and plans: Upscrape pricing