Authentication
OAuth 2.1 with dynamic client registration, and what each advertising scope grants.
How a client connectsLink to this section
The endpoint speaks OAuth 2.1. Given only the URL, a client bootstraps itself: it receives a 401 carrying a WWW-Authenticate header, reads the protected resource metadata, registers itself, and walks the authorisation flow with PKCE.
| Document | URL |
|---|---|
| Protected resource metadata (RFC 9728) | https:/ |
| Authorization server metadata (RFC 8414) | https:/ |
| Dynamic client registration (RFC 7591) | Advertised in the metadata above |
| MCP manifest | https:/ |
What the gateway asks each platformLink to this section
A scope is what the platform grants. It is not what the gateway does with it. Where a platform publishes no read-only scope, the restriction is enforced here instead: on the Free plan no write tool is announced, and calling one is refused before it reaches the platform.
Requested scopes, by source
| Source | Scope | Grants | Writes |
|---|---|---|---|
| Meta Ads | ads_read | Read Meta campaigns, insights, creatives and audiences. | No |
| Meta Ads | ads_management | Create and manage Meta campaigns, ad sets, ads, creatives and audiences, including budgets and status. Writes require a paid plan and explicit confirmation. | Yes |
| Meta Ads | business_ | Access Business Manager assets, including owned and shared ad accounts, Pages and catalogs. This permission also permits Business Manager changes. | Yes |
| Meta Ads | pages_show_list | List the Facebook Pages you manage and discover linked Instagram professional accounts. | No |
| Meta Ads | pages_ | Read Page posts, media and engagement metadata used by your ads and content reports. | No |
| Meta Ads | pages_manage_ads | Create and manage ads associated with your Facebook Pages. | Yes |
| Meta Ads | read_insights | Read insights for Facebook Page content you can access. | No |
| Meta Ads | instagram_basic | Read your linked Instagram professional account profile and media. | No |
| Meta Ads | instagram_ | Read insights for your Instagram professional account and media. | No |
| Meta Ads | catalog_ | Read product catalogs and create or update products and product sets. Writes require a paid plan and explicit confirmation. | Yes |
| Pinterest Ads | ads:read | Read Pinterest campaigns, ad groups, ads and analytics. | No |
| Pinterest Ads | ads:write | Pause, resume and change budgets on Pinterest campaigns. Only reachable on a paid plan. | Yes |
| Google Ads | https:/ | Read and write on Google Ads. Google publishes no read-only alternative, so read-only enforcement is done by this gateway, not by Google. | Yes |
| TikTok Ads | none in the authorization URL | TikTok attaches permissions to the app in Business Center. | n/a |
| Search Console | https:/ | Read Search Console performance, index coverage and sitemaps. Cannot modify anything. | No |
| Google Analytics 4 | https:/ | Read GA4 reports, metadata and property configuration. Cannot modify anything. | No |