Skip to main content
OAuth scopes define which Zapier resources your application can access. Request only the scopes required for the endpoints or flows your application uses. Endpoint-specific scope requirements are listed on each API reference page. When requesting more than one scope in an OAuth flow or token exchange, pass scopes as a space-separated string. 
zap zap:write authentication

​
Workflow API scopes

ScopeDescription
profileRead profile information for the authenticated user.
zapRead Zaps that use your integration.
zap:writeCreate or modify Zaps.
zap:allRead all Zaps owned by the authenticated user.
zap:account:allRead all Zaps the authenticated user can access in their account, including shared Zaps.
zap:runsRead Zap run history.
action:runRun an action.
authenticationRead app authentications.
authentication:writeCreate or update app authentications.
connection:readRead connections.
connection:writeCreate or update connections, or request a connect token for Connect UI and MCP authorization flows.

​
White Label and MCP scopes

ScopeDescription
externalAccess White Label APIs that use partner-signed external JWT token exchange.
mcp:runRun tools through a Zapier-hosted MCP server after completing the MCP authorization flow.

​
Choosing Zap read scopes

Use the narrowest Zap read scope that supports your use case:
  • Use zap when you only need Zaps that use your integration.
  • Use zap:all when you need all Zaps owned by the authenticated user.
  • Use zap:account:all when you need Zaps the authenticated user can access across their account, including shared Zaps.