generated: '2026-08-28'
method: probed
source: https://mcp.budgetpixel.com/.well-known/oauth-authorization-server
note: derive-oauth-scopes.py found no oauth2 securityScheme in the OpenAPI -- correctly, because the REST
  API is bearer-API-key only and has no scope surface at all. The OAuth surface belongs entirely to the
  MCP server, and these scopes were read from its live RFC 8414 metadata document rather than from a spec.
applies_to: https://mcp.budgetpixel.com/mcp (MCP server), not the REST API
flows:
  authorization_code:
    authorization_endpoint: https://mcp.budgetpixel.com/oauth/authorize
    token_endpoint: https://mcp.budgetpixel.com/oauth/token
    pkce: S256 (required)
    grant_types:
    - authorization_code
    - refresh_token
    token_endpoint_auth_methods:
    - client_secret_post
    - client_secret_basic
    dynamic_registration: https://mcp.budgetpixel.com/oauth/register
scope_count: 2
scopes:
- name: openid
  description: OIDC-named scope advertised in the authorization server metadata. Note that no /.well-known/openid-configuration
    is served on any host, so this is an OAuth server offering an OIDC-named scope rather than a conformant
    OpenID Provider.
  source: 'probed: scopes_supported'
- name: profile
  description: Basic profile of the signed-in BudgetPixel account. The end user authenticates with Google
    SSO during the connect flow and the connector then acts as that account.
  source: 'probed: scopes_supported'
authorization_model:
  note: 'The scopes carry NO capability semantics -- neither openid nor profile distinguishes reading
    the model catalogue from spending credits on a 3,000-credit video generation or publishing publicly
    to the community feed. Authorization is enforced OUT OF BAND, by the account plan: any account can
    connect and call list_models, while generation, uploads and posting require Premium, Pro or Ultra.
    An agent holding a token therefore cannot tell from its scopes what it is permitted to do, or what
    an action will cost.'
  plan_gate:
  - Premium
  - Pro
  - Ultra
  anonymous: initialize and tools/list answer with no token at all (verified 2026-08-28); only tool CALLS
    require the session.