MangaBaka
Sign in
Discord Join our cozy Discord community to chat with like-minded people and stay up to date with MangaBaka (and get the BAKA server tag)

OAuth scopes

How the data and the API work, and why.

A scope is one permission your app asks for and the user approves on the consent screen.

Ask for the fewest you need: every scope is a line the user has to accept. The table is generated from the API itself, so it always matches what the server enforces.

Scope What the user approves Endpoints that accept it
openid See your account ID -
profile See your profile information -
badges See the badges on your profile -
library.read See everything in your library GET /v1/my/library
GET /v2/my/library
GET /v2/my/library/changes
GET /v1/my/library/{series_id}
GET /v1/my/library/batch
GET /v1/my/series/recommendations
GET /v1/my/series/recommendations/status
GET /v1/my/series/discover/top-genres
library.write Add, change and delete entries in your library POST /v1/my/library/{series_id}
PUT /v1/my/library/{series_id}
PATCH /v1/my/library/{series_id}
DELETE /v1/my/library/{series_id}
POST /v1/my/library/batch
stack.read See your stacks, drafts included GET /v2/my/stacks
GET /v2/my/stacks/{id}
GET /v2/my/series/{id}/stacks
GET /v2/my/stacks/saved
GET /v2/my/stacks/followed
GET /v2/my/stacks/status
stack.write Create, change and delete your stacks POST /v2/my/stacks
PUT /v2/my/stacks/{id}
DELETE /v2/my/stacks/{id}
PUT /v2/my/stacks/{id}/visibility
POST /v2/my/stacks/{id}/entries
PUT /v2/my/stacks/votes/{id}
DELETE /v2/my/stacks/votes/{id}
PUT /v2/my/stacks/saved/{id}
DELETE /v2/my/stacks/saved/{id}
PUT /v2/my/stacks/followed/{id}
DELETE /v2/my/stacks/followed/{id}
mod Use your moderator permissions -
offline_access Stay connected without asking you to sign in again -
any Nothing beyond signing in GET /v1/my/profile

Things to know#↑

  • Writing doesn't imply reading. A token with only library.write can't read the library; ask for library.read too. The same goes for stack.write and stack.read.
  • openid and profile identify the user. Endpoints marked any accept every valid token, whatever its scopes.
  • offline_access adds a refresh token, so your app stays connected after the access token expires.
  • mod tokens expire sooner than others.

Endpoints that only take a personal access token don't appear here.