Inspect.dev authentication and OAuth documentation - Inspect Documentation

Official Inspect.dev account access uses OAuth 2.0 Authorization Code with PKCE through Clerk. The free CLI workflow does not require authentication, and Inspect does not issue broad API keys, shared passwords, or unattended machine credentials.

OAuth discovery

Inspect is the protected resource at https://inspect.dev. Its RFC 9728 protected-resource metadata identifies https://clerk.inspect.dev as the authorization server. Clerk publishes authorization-server and OpenID Connect metadata at:

https://clerk.inspect.dev/.well-known/oauth-authorization-server
https://clerk.inspect.dev/.well-known/openid-configuration

Run inspect login.
The CLI creates a PKCE verifier and challenge and opens the authorization page.
A human approves the browser flow.
Verify the session with inspect account --json.

Agents may start the login flow, but must never ask a user to paste a password, access token, or other credential into a conversation.

Scopes and permissions

Supported scopes include openid, profile, email, offline_access, and user:org:read. Request only the scopes needed for the current task. See the Inspect permission matrix for the endpoint-to-scope mapping.

Authentication errors

Missing, expired, or invalid credentials return HTTP 401 with a structured Inspect error and a WWW-Authenticate discovery hint. Valid credentials without sufficient permission return HTTP 403. Follow the response hint and retry only when the operation is safe. Append .md to this page URL for a low-overhead Markdown version of the guide.