Scope Discovery Metadata

Agent platforms populate their consent screens from the scopes_supported field in your authorization server metadata. By default, Auth0 lists only a static set of OIDC scopes in the authorization server metadata, so API-defined scopes are invisible to agents. When you configure a UCP resource server, Auth0 adds the UCP scopes to the scopes_supported field.

Endpoints

Auth0 merges the UCP resource server’s scopes into scopes_supported on both documents:

https://YOUR_AUTH0_DOMAIN/.well-known/openid-configuration
https://YOUR_AUTH0_DOMAIN/.well-known/oauth-authorization-server

Example

{
  "issuer": "https://acme.auth0.com/",
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access",
    "dev.ucp.shopping.order:read",
    "dev.ucp.shopping.cart:manage",
    "dev.ucp.shopping.checkout:manage"
  ]
}

Behavior

Auth0 returns all scopes defined on the UCP resource server, merged with the standard OIDC scopes.
Tenants that haven’t configured a UCP resource server see no change to their metadata.
Only one API per tenant can be configured as a UCP resource server and publish its UCP scopes to discovery metadata.
Changes to the resource server’s scopes or type are reflected in the metadata after the tenant cache refreshes.

Get Started

Reference

Scope Discovery Metadata

Endpoints

Example

Behavior

​Endpoints

​Example

​Behavior

Endpoints

Example

Behavior