generated: '2026-09-03'
method: searched
source: https://api.dialnexa.com/.well-known/oauth-authorization-server + https://dialnexa.com/docs/mcp-tools/overview.md
docs: https://dialnexa.com/docs/mcp-tools/overview
description: >-
  OAuth scopes apply to the MCP surface only. The REST /v1 API uses dashboard-provisioned API keys
  (bearer) and declares no oauth2 securityScheme in its OpenAPI; the dialnexa.com
  oauth-authorization-server metadata says plainly that public OAuth token issuance is not
  available for the REST API. The api.dialnexa.com authorization server (OAuth 2.1,
  authorization-code + PKCE S256, PAR, DPoP) issues tokens for the MCP endpoint
  https://api.dialnexa.com/v1/mcp.
oauth_surface: https://api.dialnexa.com/v1/mcp
authorization_server: https://api.dialnexa.com
scopes:
- name: mcp:read
  description: Read DialNexa workspace data through MCP tools.
- name: mcp:write
  description: Run state-changing MCP tools after any tool-specific confirmation requirements are satisfied.
- name: offline_access
  description: Let a compatible client refresh access without re-authenticating every request.
- name: openid
  description: OpenID Connect scope advertised by the authorization server metadata (id_token issuance).
scope_count: 4
notes:
- OAuth grants are tied to the approving user AND the workspace chosen on the consent screen; tool arguments cannot switch workspaces.
- API-key Bearer auth is the alternative for MCP clients that support custom headers; the key resolves the workspace.