generated: '2026-08-09'
method: searched
source: https://zillapi.com/.well-known/oauth-authorization-server
docs: https://zillapi.com/auth.md
note: >-
  Not derivable from the OpenAPI — openapi/zillapi-openapi-original.json declares only the `bearerAuth`
  http scheme. The OAuth 2.1 surface and its single scope are published in the RFC 8414 authorization
  server metadata and the RFC 9728 protected resource metadata, both harvested to well-known/.
schemes:
  - name: oauth2
    source: well-known/zillapi-oauth-authorization-server.json
    issuer: https://api.zillapi.com
    flows:
      - flow: authorizationCode
        authorizationUrl: https://api.zillapi.com/oauth/authorize
        tokenUrl: https://api.zillapi.com/oauth/token
        pkce: S256
scopes:
  - scope: mcp:access
    description: >-
      The single scope Zillapi issues. Grants an agent access to the hosted MCP server at
      https://api.zillapi.com/mcp and the same /v1 REST surface a long-lived API key reaches; both auth
      paths bill against the same account.
    flows: [authorizationCode]
    sources:
      - well-known/zillapi-oauth-authorization-server.json
      - well-known/zillapi-oauth-protected-resource.json
      - well-known/zillapi-mcp-server-card.json
model:
  granularity: coarse
  notes: >-
    A single all-or-nothing scope — there is no read/write split and no per-resource scoping. An agent
    granted mcp:access can reach every /v1 operation, including webhook creation and revocation.
    Credit balance and plan, not scope, are what bound what a token can spend.