The Kinde management API uses JSON Web Tokens (JWTs) to authenticate requests. The scope claim in a token controls which API endpoints the application can access.
read:users — read user detailsupdate:users — update user detailsread:roles — read rolesupdate:roles — update roles
Scopes are assigned when you authorize an M2M application and can be updated at any time. Enable only what you need — fewer scopes means a smaller attack surface.
By default, a token request returns all scopes enabled for that application. To limit the scopes in a token, include a scope parameter in the request body. This is useful when you want tighter control over what a specific token can access.
--url ' https://<your_subdomain>.kinde.com/oauth2/token ' \
--header ' content-type: application/x-www-form-urlencoded ' \
--data grant_type=client_credentials \
--data ' client_id=<your_m2m_client_id> ' \
--data ' client_secret=<your_m2m_client_secret> ' \
--data ' audience=https://<your_subdomain>.kinde.com/api ' \
--data ' scope=read:users update:users '
Use this if you’re seeing a scope error, need to grant additional access, or want to restrict what an application can do.
Go to Settings > Applications and select the relevant M2M application.
On the left, select APIs .
Select the three dots next to the Kinde management API, then choose Manage scopes .
Select the scopes to include in the token. Enable only the minimum scopes required.
Select Save .
These are the most commonly used scopes. Your Kinde dashboard shows the full list when you configure an M2M application.
Scope Description read:usersRead user details create:usersCreate users update:usersUpdate user details delete:usersDelete users
Scope Description read:organizationsRead organizations create:organizationsCreate organizations update:organizationsUpdate organizations delete:organizationsDelete organizations
Scope Description read:organization_usersRead users in an organization create:organization_usersAdd users to an organization update:organization_usersUpdate organization user details delete:organization_usersRemove users from an organization
Scope Description read:rolesRead roles create:rolesCreate roles update:rolesUpdate roles delete:rolesDelete roles read:organization_user_rolesRead roles assigned to organization users create:organization_user_rolesAssign roles to organization users delete:organization_user_rolesRemove roles from organization users
Scope Description read:permissionsRead permissions create:permissionsCreate permissions update:permissionsUpdate permissions delete:permissionsDelete permissions
Scope Description read:applicationsRead application details create:applicationsCreate applications update:applicationsUpdate application details delete:applicationsDelete applications
Scope Description read:feature_flagsRead feature flags create:feature_flagsCreate feature flags update:feature_flagsUpdate feature flags delete:feature_flagsDelete feature flags
Scope Description read:environmentsRead environment details update:environmentsUpdate environment settings read:environment_variablesRead environment variables create:environment_variablesCreate environment variables update:environment_variablesUpdate environment variables delete:environment_variablesDelete environment variables
Scope Description read:connectionsRead connection details create:connectionsCreate connections update:connectionsUpdate connections delete:connectionsDelete connections
Scope Description read:webhooksRead webhooks create:webhooksCreate webhooks update:webhooksUpdate webhooks delete:webhooksDelete webhooks