generated: '2026-08-13'
method: probed
source: https://app.nutshell.com/.well-known/oauth-authorization-server
docs: https://support.nutshell.com/en/articles/12631143-mcp-server
summary:
  count: 2
  applies_to: MCP server OAuth only
  note: 'These scopes are read from the provider''s own RFC 8414 metadata, not from the OpenAPI — the REST spec
    declares only HTTP Basic and has no oauth2 securityScheme, so derive-oauth-scopes.py correctly found nothing.
    The two scopes govern the OAuth authorization used by the Nutshell MCP server. Note the mismatch worth flagging:
    the authorization server advertises a write scope, while Nutshell''s help article states the MCP server "can
    only read your data and cannot make any changes". Nutshell does not publish a per-permission scope reference
    page; API-key permissions are chosen from an undocumented permission-type list in Setup > API keys.'
scopes:
- name: read
  description: Read access to Nutshell CRM data granted to an OAuth client (the MCP server and any registered connector).
  source: well-known/nutshell-oauth-authorization-server.json
- name: write
  description: Write access advertised by the authorization server. Advertised in metadata and in the MCP 401 challenge
    (scope="read write"); not exercised by the documented MCP tool set.
  source: well-known/nutshell-oauth-authorization-server.json
authorization_server:
  issuer: https://app.nutshell.com
  authorization_endpoint: https://app.nutshell.com/oauth/authorize
  token_endpoint: https://app.nutshell.com/oauth/token
  registration_endpoint: https://app.nutshell.com/oauth/register
  revocation_endpoint: https://app.nutshell.com/oauth/revoke
  grant_types_supported:
  - authorization_code
  response_types_supported:
  - code
  code_challenge_methods_supported:
  - S256
  token_endpoint_auth_methods_supported:
  - none
  - client_secret_post
  - client_secret_basic
api_key_permissions:
  documented: false
  note: The help centre says a "permission type" is selected when creating an API key and names only "API + user
    impersonation" (for Zapier). No permission matrix is published.
  source: https://support.nutshell.com/en/articles/8429060-api-keys-create-api-keys-for-3rd-party-apps