# OAuth Permission Explorer

> What an OAuth consent request really allows: scopes, risky combinations and flow problems. Paste OAuth scopes or a full authorization URL for Google, GitHub, Microsoft Graph, Slack or generic OpenID Connect. Every scope is explained from the provider's official documentation with a sensitivity rating; risky combinations (read + send mail, offline access to files, push code + delete repositories, CI workflow edits) and unsafe request settings (implicit flow, missing PKCE or state, plain-HTTP redirect) are flagged. Unknown scopes are listed, never guessed.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://oauthpermissionexplorer.usefulweb.site/ (interactive tool at https://oauthpermissionexplorer.usefulweb.site/tool)
- JSON API: POST https://oauthpermissionexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://oauthpermissionexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://oauthpermissionexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://oauthpermissionexplorer.usefulweb.site/mcp - tool `oauth_permission_explorer`

## Inputs
- request (textarea, required): Scopes or authorization URL - Scopes separated by spaces or commas, or the whole URL from the consent link.
- provider (select): Provider

## Method
- Input is split on spaces/commas; a full URL is parsed for scope, user_scope (Slack), client_id, redirect_uri, response_type, prompt, access_type, code_challenge(_method), state and nonce.
- Provider = your choice, else the authorization host (accounts.google.com, github.com, login.microsoftonline.com, slack.com), else the provider most scopes uniquely belong to. Microsoft Graph scopes match with or without the https://graph.microsoft.com/ prefix, case-insensitively.
- Scope descriptions come from a curated dataset copied from each provider's official scope reference (URL per scope). Only scopes found on those pages are included; anything else is reported as unknown.
- Sensitivity (low/medium/high/critical) is an editorial rating of what a leaked token could do; Google's own Non-sensitive/Sensitive/Restricted class and Microsoft's admin-consent flag are shown where documented.
- Risky combinations are rules over capabilities (e.g. mail.read + mail.send, repo.write + repo.delete, offline + files.read). Flow checks follow RFC 9700 (OAuth 2.0 Security BCP) and RFC 7636 (PKCE).