---
title: OAuth scopes
description: The OAuth scopes the Points MCP server supports and which tool needs which. Generated from code.
url: https://thepoints.io/docs/agents/reference/scopes
audience: [agents, operators, developers]
status: Live
---

# OAuth scopes

> **Agent Pay status:** Approve does not execute. Execution: not enabled. ACH settlement: not enabled. prepare_payment never moves money. Machine-readable: [/docs/agents/status.json](/docs/agents/status.json).

Generated from code. Machine-readable: [/docs/agents/reference/scopes.json](/docs/agents/reference/scopes.json).

The same list is published as `scopes_supported` in [/.well-known/oauth-protected-resource](/.well-known/oauth-protected-resource). A client that registers dynamically without asking for scopes gets `module-status:read`. The account owner reviews the requested scopes on POINTS before granting them.

| Scope | Grants | Tools |
|---|---|---|
| `balances:read` | Read the balance summary. | `get_account_summary` |
| `transactions:read` | Read the sandbox transaction list. | `list_transactions` |
| `rewards:read` | Adds the optional rewards summary to get_account_summary. | None directly |
| `optimize:read` | Read savings suggestions. | `find_savings_opportunities` |
| `payments:draft` | Prepare payment drafts for human approval. Never moves money. | `prepare_payment` |
| `payments:status` | Read the status of payment drafts on the connected account. | `get_payment_status` |
| `identity:read` | Read the redacted connection identity. | `get_connection_identity` |
| `module-status:read` | Read account and module status, wallet status, and the Agent Pay policy vocabulary. | `get_account_status`, `get_agent_pay_policy_vocabulary`, `get_wallet_status` |