OAuth scopes
Request the smallest set of scopes needed for the intended work.
| Scope | Grants access to |
|---|---|
domains.search | Search domain availability and pricing |
domains.read | List and inspect accessible domains |
domains.renew | Prepare owner-authorized renewal checkout requests |
dns.read | Read managed DNS records |
dns.write | Request DNS record mutations |
domains.settings.write | Change domain settings and AT Protocol handle configuration |
teams.read | List visible team members and invitations |
teams.write | Invite, update, cancel, and remove team members as owner |
checkout.create | Create and monitor registration and renewal checkout requests |
Common scope sets
| Task | Suggested scopes |
|---|---|
| Search only | domains.search |
| Inventory review | domains.read |
| DNS audit | domains.read dns.read |
| DNS operator | domains.read dns.read dns.write |
| Registration assistant | domains.search checkout.create |
| Renewal assistant | domains.read domains.renew checkout.create |
The signed-in user’s domain authority is always checked separately. See Authorization and Team tools.