Prebuilt Audience Scopes for Client Credentials

This page lists all scopes available for the LoginRadius prebuilt audiences used in the Client Credentials Flow. Scopes are configured per OIDC application in the Admin Console under Application → API tab and are automatically included in the issued access_token — they are not passed in the token request.

Account Management

Audience: https://api.loginradius.com/identity/v2/manage

Scopes for managing customer identity records via the LoginRadius Identity Management APIs.

Scope	Description
`all`	All Account Management APIs
`read:users`	Profile Read
`write:users`	Create and Update Profile
`delete:users`	Profile Delete
`all:users`	All Operations on Profile
`create:email_verification_token`	Email Verification Token
`create:forgot_password_token`	Forgot Password Token
`update:users_access_token`	Access Token based on UID or User impersonation API
`read:users_privacy_policy_history`	Privacy Policy History
`read:roles`	Profile Role Read
`write:roles`	Profile Role Create and Update
`delete:roles`	Profile Role Delete
`all:roles`	All Operations on Profile Role
`read:custom_objects`	Profile Custom Object Read
`write:custom_objects`	Profile Custom Object Create and Update
`delete:custom_objects`	Profile Custom Object Delete
`all:custom_objects`	All Operations on Profile Custom Object
`write:sott`	Create SOTT Token
`read:sott`	Read SOTT Tokens
`all:sott`	All Operations on SOTT Tokens
`write:tokens`	Create Tokens
`delete:tokens`	Revoke Tokens
`read:consentlogs`	Read Consent Logs
`verify:reauth`	Reverify Pin Auth

The all scope grants access to the complete Account Management API surface. Use granular scopes (e.g. read:users, write:users) where possible to apply least-privilege.

Config Management

Audience: https://api.loginradius.com/v2/manage

Scopes for managing LoginRadius tenant-level platform configuration via the Configuration Management APIs.

Scope	Description
`all`	All Management APIs
`read:sott`	Read SOTT Tokens
`write:sott`	Create SOTT Token
`all:sott`	All Operations on SOTT Tokens
`read:oauth_providers`	Read OAuth Providers
`write:oauth_providers`	Create OAuth Providers
`delete:oauth_providers`	Delete OAuth Providers
`all:oauth_providers`	All Operations on OAuth Providers
`read:social_providers`	Read Social Providers
`write:social_providers`	Create Social Providers
`delete:social_providers`	Delete Social Providers
`all:social_providers`	All Operations on Social Providers
`read:webhooks`	Read Webhook
`write:webhooks`	Create and Update Webhook
`delete:webhooks`	Delete Webhook
`all:webhooks`	All Operations on Webhook
`read:orgs`	Read Organization Data
`write:orgs`	Create and Update Organization Data
`delete:orgs`	Delete Organization Data
`all:orgs`	All Operations on Organizations
`read:org_connections`	Read Organization Connections
`write:org_connections`	Create and Update Organization Connections
`delete:org_connections`	Delete Organization Connections
`all:org_connections`	All Operations on Organization Connections
`read:org_directories`	Read Organization Directories
`write:org_directories`	Create and Update Organization Directories
`delete:org_directories`	Delete Organization Directories
`all:org_directories`	All Operations on Organization Directories
`read:roles`	Read Roles Data
`write:roles`	Create and Update Roles
`delete:roles`	Delete Roles
`all:roles`	All Operations on Roles
`read:permissions`	Read Permissions Data
`write:permissions`	Create and Update Permissions
`delete:permissions`	Delete Permissions
`all:permissions`	All Operations on Permissions
`read:invitations`	Read Organization Invitations
`write:invitations`	Create and Update Organization Invitations
`delete:invitations`	Delete Organization Invitations
`all:invitations`	All Operations on Organization Invitations
`read:user_roles`	Read User Roles
`write:user_roles`	Create and Update User Roles
`delete:user_roles`	Delete User Roles
`all:user_roles`	All Operations on User Roles
`read:custom_fields`	Read Custom Fields
`write:custom_fields`	Create and Update Custom Fields
`delete:custom_fields`	Delete Custom Fields
`all:custom_fields`	All Operations on Custom Fields
`read:passkeys`	Read Passkey Config
`write:passkeys`	Create and Update Passkey Config
`all:passkeys`	All Operations on Passkey Config
`read:mfa`	Read MultiFactor Config
`write:mfa`	Create and Update MultiFactor Config
`all:mfa`	All Operations on MultiFactor Config
`read:security_questions`	Read Security Questions
`write:security_questions`	Create and Update Security Questions
`delete:security_questions`	Delete Security Questions
`all:security_questions`	All Operations on Security Questions
`read:password_policies`	Read Password Policy
`write:password_policies`	Create and Update Password Policy
`all:password_policies`	All Operations on Password Policy
`read:oauth_clients`	Read OAuth Clients
`write:oauth_clients`	Create and Update OAuth Clients
`delete:oauth_clients`	Delete OAuth Clients
`all:oauth_clients`	All Operations on OAuth Clients
`read:jwt_clients`	Read JWT Identity Providers
`write:jwt_clients`	Create and Update JWT Identity Providers
`delete:jwt_clients`	Delete JWT Identity Providers
`all:jwt_clients`	All Operations on JWT Identity Providers
`read:jwt_providers`	Read JWT Service Providers
`write:jwt_providers`	Create and Update JWT Service Providers
`delete:jwt_providers`	Delete JWT Service Providers
`all:jwt_providers`	All Operations on JWT Service Providers
`read:saml_clients`	Read SAML Identity Providers
`write:saml_clients`	Create and Update SAML Identity Providers
`delete:saml_clients`	Delete SAML Identity Providers
`all:saml_clients`	All Operations on SAML Identity Providers
`read:saml_providers`	Read SAML Service Providers
`write:saml_providers`	Create and Update SAML Service Providers
`delete:saml_providers`	Delete SAML Service Providers
`all:saml_providers`	All Operations on SAML Service Providers
`read:workflows`	Read Workflows
`write:workflows`	Create and Update Workflows
`delete:workflows`	Delete Workflows
`all:workflows`	All Operations on Workflows
`read:domain_restrictions`	Read Domain Restrictions
`write:domain_restrictions`	Create and Update Domain Restrictions
`all:domain_restrictions`	All Operations on Domain Restrictions
`read:ip_restrictions`	Read IP Restrictions
`write:ip_restrictions`	Create and Update IP Restrictions
`delete:ip_restrictions`	Delete IP Restrictions
`all:ip_restriction`	All Operations on IP Restrictions
`read:captcha`	Read Captcha Configuration
`write:captcha`	Create and Update Captcha Configuration
`all:captcha`	All Operations on Captcha Configuration
`read:sms_templates`	Read SMS Templates
`write:sms_templates`	Create and Update SMS Templates
`delete:sms_templates`	Delete SMS Templates
`all:sms_templates`	All Operations on SMS Templates
`read:email_templates`	Read Email Templates
`write:email_templates`	Create and Update Email Templates
`delete:email_templates`	Delete Email Templates
`all:email_templates`	All Operations on Email Templates
`read:consent`	Read Consent
`write:consent`	Create and Update Consent
`delete:consent`	Delete Consent
`all:consent`	All Operations on Consent

The all scope grants access to the complete Config Management API surface. Use granular scopes (e.g. read:email_templates, write:workflows) where possible to apply least-privilege.

Scope Selection Guidelines

When configuring an OIDC application for the Client Credentials Flow, select only the scopes required for the specific M2M use case:

Account Management

Use Case	Recommended Scopes
Read-only user data sync	`read:users`
User provisioning pipeline	`write:users`
Full user lifecycle management	`all:users`
Role assignment automation	`read:roles`, `write:roles`
Token management service	`write:tokens`, `delete:tokens`
Full admin access	`all`

Config Management

Use Case	Recommended Scopes
Email template deployment pipeline	`read:email_templates`, `write:email_templates`
Webhook management automation	`read:webhooks`, `write:webhooks`, `delete:webhooks`
SSO provider provisioning	`read:saml_providers`, `write:saml_providers`
MFA policy enforcement	`read:mfa`, `write:mfa`
Password policy management	`read:password_policies`, `write:password_policies`
Full config access	`all`

Avoid assigning all unless the service genuinely requires unrestricted access. Broad scopes increase the blast radius of a compromised client_secret.