> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inspect.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Inspect.dev OAuth permissions and scopes

> Official Inspect.dev OAuth scopes and API endpoint permissions for developers and coding agents, with least-privilege guidance.

Inspect.dev uses Clerk OAuth 2.0 Authorization Code with PKCE. Request only the
scopes required for the current operation. The free CLI workflow and public
changelog API require no authentication.

## Scope matrix

| Scope            | Permission                                                 | Used by                                        |
| ---------------- | ---------------------------------------------------------- | ---------------------------------------------- |
| `openid`         | Identify the signed-in user.                               | Authenticated API endpoints                    |
| `profile`        | Read the user display name.                                | User, plan, and subscription endpoints         |
| `email`          | Read the account email address.                            | User, plan, and subscription endpoints         |
| `offline_access` | Refresh a human-approved session.                          | Official CLI login                             |
| `user:org:read`  | Read organization membership for team subscription access. | Organization-scoped plan and billing endpoints |

## Least-privilege rules

* Public discovery and changelog endpoints use no scopes.
* Account reads use `openid profile email`.
* Request `user:org:read` only when the selected billing account is an organization.
* Billing operations require an authenticated human and explicit user approval.

## Discovery and errors

See the [Inspect authentication guide](/developers/authentication),
[OAuth protected-resource metadata](https://inspect.dev/.well-known/oauth-protected-resource),
and [Inspect OpenAPI specification](https://inspect.dev/openapi.json).

A missing or invalid credential returns HTTP 401 with a `WWW-Authenticate`
discovery hint. Valid credentials without sufficient permission return HTTP 403
as structured JSON.