Lexicon Garden
tools / scope builder

OAuth scope builder

Paste a scope string to see exactly what it grants, or build one from parts. Both sides stay in sync.

What this grants

one entry per scope, in order

Scope format reference

BaseatprotoRequired for all atproto OAuth sessions
Permission setinclude:nsid[?aud=...]include:app.bsky.permissions.read
Repositoryrepo[:collection][?action=...]repo:app.bsky.feed.post?action=create&action=delete
RPCrpc[:lxm][?aud=...]rpc:app.bsky.feed.getTimeline?aud=did:web:api.bsky.app
Blobblob[:accept]blob:image/*
Accountaccount[:attr][?action=...]account:email, account:repo?action=manage
Handleidentity[:attr]identity:handle, identity:*
Spacespace:type[?authority=...&skey=...&collection=...&action=...&manage=...]space:app.bulleted.space?action=read
Transitiontransition:generic | chat.bsky | emailLegacy app-password equivalent access

Scopes are space-separated. Partial wildcards such as app.bsky.* aren't supported. See the AT Protocol permission spec.