Authentication
OAuth 2.1 with dynamic client registration, and what each advertising scope grants.
How a client connectsLink to this section
The endpoint speaks OAuth 2.1. Given only the URL, a client bootstraps itself: it receives a 401 carrying a WWW-Authenticate header, reads the protected resource metadata, registers itself, and walks the authorisation flow with PKCE.
| Document | URL |
|---|---|
| Protected resource metadata (RFC 9728) | https:/ |
| Authorization server metadata (RFC 8414) | https:/ |
| Dynamic client registration (RFC 7591) | Advertised in the metadata above |
| MCP manifest | https:/ |
What the gateway asks each platformLink to this section
A scope is what the platform grants. It is not what the gateway does with it. Where a platform publishes no read-only scope, the restriction is enforced here instead: on the Free plan no write tool is announced, and calling one is refused before it reaches the platform.
Requested scopes, by source
| Source | Scope | Grants | Writes |
|---|---|---|---|
| Meta Ads | ads_read | Read Meta campaigns, insights, creatives and audiences. | No |
| Meta Ads | ads_management | Pause, resume and change budgets on Meta campaigns, ad sets and ads. Only reachable on a paid plan. | Yes |
| Pinterest Ads | ads:read | Read Pinterest campaigns, ad groups, ads and analytics. | No |
| Pinterest Ads | ads:write | Pause, resume and change budgets on Pinterest campaigns. Only reachable on a paid plan. | Yes |
| Google Ads | https:/ | Read and write on Google Ads. Google publishes no read-only alternative, so read-only enforcement is done by this gateway, not by Google. | Yes |
| TikTok Ads | none in the authorization URL | TikTok attaches permissions to the app in Business Center. | n/a |
| Search Console | https:/ | Read Search Console performance, index coverage and sitemaps. Cannot modify anything. | No |
| Google Analytics 4 | https:/ | Read GA4 reports, metadata and property configuration. Cannot modify anything. | No |