Scopes
Available OAuth2 permission scopes for Vacation Tracker.
Scopes define the level of access your application is requesting. Users see the requested scopes on the consent screen before granting permission.
Available scopes
| Scope | Used by | Description |
|---|---|---|
openid | Any | Verify your identity |
email | Any | View your email address |
profile | Any | View your profile information |
mcp:workspace:read | MCP | View your workspace's departments, locations, and leave types |
mcp:users:read | MCP | View your workspace's users, their departments and approvers |
mcp:leaves:read | MCP | View leave requests and approvals in your workspace |
mcp:workspace:write | MCP | Manage your workspace's departments, locations, and leave types |
mcp:users:write | MCP | Manage your workspace's users and labels |
mcp:leaves:write | MCP | Create, edit, and approve leave requests in your workspace |
zapier:webhooks | Zapier | Receive notifications about your leave requests |
Zapier authenticates with the legacy OAuth2 flow, which is kept supported for backwards compatibility with existing Zapier integrations. New integrations should use the modern flow.
MCP clients register as public clients via Dynamic Client Registration and can request the full set of mcp:* scopes without re-registering. What each request can actually do is then capped by your role in the workspace: every role can use mcp:leaves:write, but only location admins and admins can use mcp:users:write and mcp:workspace:write. If a token lacks a scope a tool needs, the MCP server answers with an insufficient_scope challenge and the client asks you to consent again.
Default scope
If no scope parameter is provided in the authorization request, public MCP clients default to the full set of mcp:* scopes plus openid, profile, and email. All other OAuth clients default to openid.
Scope validation
Each registered OAuth client has a list of allowed scopes. If your authorization request includes a scope that is not in your client's allowed list, the request will be rejected with an invalid_scope error:
{
"error": "invalid_scope",
"error_description": "Scope 'zapier:webhooks' is not allowed for this client"
}Requesting multiple scopes
Separate multiple scopes with a space in the scope parameter:
scope=openid email profileWhen URL-encoding:
scope=openid%20email%20profile