OAuth scopes and account boundaries
Understand openid, profile, email and surcharge in ShareAI Builder OAuth, including identity-only access and organization privacy.
On this page
A scope is a named permission requested by an application and approved as part of an authorization. Check the scopes returned with the token; asking for a permission does not prove it was granted.
| Scope | Meaning | Use it when |
|---|---|---|
openid | Required for managed Builder sign-in and a client-specific subject. | Your application signs in a ShareAI customer. |
profile | Profile claims permitted for the chosen account. | Your application needs a display name. |
email | Email claims where permitted for the chosen account. | Your application needs an approved email claim. |
surcharge | Authorizes inference under an accepted application usage agreement. | The selected ShareAI account will fund application inference. |
Identity-only access#
A grant containing openid profile email without surcharge does not grant balance access or paid inference. It also does not authorize Provider API, Device API or Creator API operations. Those interfaces have their own credentials and rules.
Who is authorizing?#
The user can authorize their personal account or an organization for which they have the required authority. The public subject is scoped to the OAuth client and account. Store that opaque subject rather than a raw WordPress user ID, provider ID or a subject obtained from another client.
Organization privacy#
An organization authorization identifies the organization. Do not assume it includes the approving administrator’s personal email, display name or avatar. Treat absent optional claims as absent and design your app so they are not required unexpectedly.
Request fewer scopes on refresh#
A refresh request may narrow the scope of the resulting access token. It cannot add a permission the grant never authorized. To add inference access or approve a higher fee, send the customer through a new interactive authorization.
Provider and device permissions are separate#
Provider API scopes apply to provider access tokens. Device API access is bound to one provider–device relationship; do not invent OAuth scope names for it.
Last updated September 15, 2026