generated: '2026-08-14'
method: probed
source: https://api.fireflies.ai/.well-known/oauth-authorization-server
docs: https://docs.fireflies.ai/getting-started/mcp-configuration
description: >-
  Fireflies' OAuth surface exists ONLY for the hosted MCP server — the GraphQL API itself is
  bearer-API-key auth with no OAuth and no scopes. The scopes below are read from the provider's
  own RFC 8414 authorization-server metadata, not from an OpenAPI securityScheme (the specs in
  openapi/ declare only BearerAuth, which is why derive-oauth-scopes.py finds nothing).
scope_source: rfc8414-discovery
schemes:
- name: FirefliesMCPOAuth
  type: oauth2
  source: https://api.fireflies.ai/.well-known/oauth-authorization-server
  issuer: https://api.fireflies.ai/
  applies_to: https://api.fireflies.ai/mcp
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.fireflies.ai/authorize
    tokenUrl: https://api.fireflies.ai/token
    revocationUrl: https://api.fireflies.ai/revoke
    registrationUrl: https://api.fireflies.ai/register
    pkce: [S256]
    grant_types: [authorization_code, refresh_token]
    token_endpoint_auth_methods: [client_secret_post, none]
    dynamic_client_registration: true
- name: FirefliesMCPOAuthAlt
  type: oauth2
  source: https://mcp.fireflies.ai/.well-known/oauth-authorization-server
  issuer: https://mcp.fireflies.ai/
  applies_to: https://mcp.fireflies.ai/mcp
  flows:
  - flow: authorizationCode
    authorizationUrl: https://mcp.fireflies.ai/authorize
    tokenUrl: https://mcp.fireflies.ai/token
    revocationUrl: https://mcp.fireflies.ai/revoke
    registrationUrl: https://mcp.fireflies.ai/register
    pkce: [S256]
    grant_types: [authorization_code, refresh_token]
    token_endpoint_auth_methods: [client_secret_post, none]
    dynamic_client_registration: true
  note: >-
    mcp.fireflies.ai serves an identical metadata document under its own issuer. Both hosts front
    the same MCP product; use api.fireflies.ai/mcp, which is the URL the docs publish.
scopes:
- scope: profile
  description: Basic Fireflies user profile. Declared in scopes_supported on both the authorization-server and protected-resource metadata.
  flows: [authorizationCode]
  sources: ['https://api.fireflies.ai/.well-known/oauth-authorization-server', 'https://api.fireflies.ai/.well-known/oauth-protected-resource']
- scope: email
  description: Fireflies account email address. Declared in scopes_supported on both metadata documents.
  flows: [authorizationCode]
  sources: ['https://api.fireflies.ai/.well-known/oauth-authorization-server', 'https://api.fireflies.ai/.well-known/oauth-protected-resource']
scope_count: 2
analysis: >-
  IMPORTANT GRANULARITY FINDING — the two published scopes are identity scopes only. There is no
  scope that expresses read-vs-write, and no scope that names transcripts, meetings, channels,
  soundbites, analytics or user administration. A consenting user therefore cannot grant an agent
  read-only access: the same token that reads transcripts also drives the write tools
  (fireflies_share_meeting, fireflies_create_soundbite, fireflies_update_meeting_title,
  fireflies_move_meeting, fireflies_revoke_meeting_access). Authorization is enforced downstream by
  Fireflies plan tier and meeting ownership/admin role, not by OAuth scope.
protected_resources:
- resource: https://api.fireflies.ai/mcp
  authorization_servers: ['https://api.fireflies.ai/']
  scopes_supported: [profile, email]
  documentation: https://docs.fireflies.ai/
  spec: RFC 9728
  file: ../well-known/fireflies-api-oauth-protected-resource.json
- resource: https://mcp.fireflies.ai/mcp
  authorization_servers: ['https://mcp.fireflies.ai/']
  scopes_supported: [profile, email]
  documentation: https://docs.fireflies.ai/
  spec: RFC 9728
  file: ../well-known/fireflies-mcp-oauth-protected-resource.json
x-evidence:
  fetched: '2026-08-14'
  probes:
  - {url: 'https://api.fireflies.ai/.well-known/oauth-authorization-server', http_status: 200}
  - {url: 'https://api.fireflies.ai/.well-known/oauth-protected-resource', http_status: 200}
  - {url: 'https://mcp.fireflies.ai/.well-known/oauth-authorization-server', http_status: 200}
  - {url: 'https://mcp.fireflies.ai/.well-known/oauth-protected-resource', http_status: 200}
  - {url: 'https://api.fireflies.ai/.well-known/openid-configuration', http_status: 404}