Skip to main content
Scopes are the access levels your app needs when calling the COSMIC API. You select them per app in the developer portal; users see the same list at consent before they approve your app. Scopes are separate from the scope query parameter on the OAuth authorize URL (used for sign-in and basic profile, for example openid, email, profile) — see OAuth.

​
How scopes are used

  1. You enable the scopes your app needs in the developer portal.
  2. The consent screen shows those scopes to the user when they authorize your app.
  3. The COSMIC API enforces them on every request.
  4. GET /v1/me returns the scopes granted to the current token.

​
Scope reference

Some operations in the API reference include scope notes in their descriptions; this page lists the full catalog.

​
Choosing scopes

  • Enable only the scopes your integration needs in the developer portal.
  • Prefer read scopes first; add write scopes only where you create or update data.
  • If you ship new features later, enable the corresponding scopes in the developer portal rather than enabling broad access up front.