Inspect.dev OAuth permissions and scopes - Inspect Documentation

Inspect.dev uses Clerk OAuth 2.0 Authorization Code with PKCE. Request only the scopes required for the current operation. The free CLI workflow and public changelog API require no authentication.

Scope matrix

Scope	Permission	Used by
`openid`	Identify the signed-in user.	Authenticated API endpoints
`profile`	Read the user display name.	User, plan, and subscription endpoints
`email`	Read the account email address.	User, plan, and subscription endpoints
`offline_access`	Refresh a human-approved session.	Official CLI login
`user:org:read`	Read organization membership for team subscription access.	Organization-scoped plan and billing endpoints

Least-privilege rules

Public discovery and changelog endpoints use no scopes.
Account reads use openid profile email.
Request user:org:read only when the selected billing account is an organization.
Billing operations require an authenticated human and explicit user approval.

Discovery and errors

See the Inspect authentication guide, OAuth protected-resource metadata, and Inspect OpenAPI specification. A missing or invalid credential returns HTTP 401 with a WWW-Authenticate discovery hint. Valid credentials without sufficient permission return HTTP 403 as structured JSON.