Scopes and claims
Every scope a Gigadrive OAuth client can request, and every claim the ID token and UserInfo return for each one.
Access is granted per request
Which scopes your client may request is decided when Gigadrive creates it. There is no dynamic registration endpoint. See Requesting access.
A scope in the authorize URL asks for two separate things: which claims about the user you receive, and which API capabilities the resulting access token carries. Request the narrowest set that works, because every one of them is shown to the user on the consent screen.
OIDC scopes
| Scope | Effect |
|---|---|
openid | Turns the request into an OpenID Connect one. Required for an ID token, and required by UserInfo |
profile | Releases the name, nickname, picture, and last-updated claims |
email | Releases the email address and its verification flag |
offline_access | Issues a refresh token, valid 30 days and rotated on every use |
offline_access is never granted silently. Even a trusted client that skips consent for the other three has to show the prompt when it asks for this one.
Claims
The same rules govern the ID token and the UserInfo response, so a relying party can read either.
| Claim | Released by | Notes |
|---|---|---|
sub | Always | The Gigadrive user id, a UUID. Stable for the life of the account |
name | profile | Given and family name joined, falling back to nickname |
given_name | profile | May be null |
family_name | profile | May be null |
nickname | profile | The username, falling back to the local part of the email address |
picture | profile | May be null |
updated_at | profile | Unix seconds |
email | email | |
email_verified | email | A real boolean. True only when the mailbox has actually been proven |
The ID token adds iss, aud (your client id), iat, exp, at_hash, the nonce you sent, and a non-standard scopes array. It is signed RS256 and lives 300 seconds.
Authorize on email_verified, not on email alone. An address can sit on an account without anyone having proved control of it, so mapping Gigadrive users onto your own accounts by email address without checking the flag means trusting a self-declared string.
API capability scopes
Canonical scopes are product:resource:action. A token carrying one can call the matching endpoints on api.gigadrive.network.
| Family | Scopes |
|---|---|
| Organizations | platform:organizations:read, :write, :delete |
| API keys | platform:api_keys:read, :write, :delete |
| Applications | network:applications:read, :write, :delete |
| Deployments | network:deployments:read, :write, :delete, :trigger |
| Environment variables | network:env_vars:read, :write, :delete |
| Storage buckets | network:storage_buckets:read, :write, :delete |
| Storage objects | network:storage_objects:read, :write, :delete |
| S3 credentials | network:storage_s3_credentials:read, :write, :delete |
| Request logs | network:requests:read |
| Sticky sessions | network:sticky_sessions:write |
| Image optimization | network:image_optimization:read, :purge |
| Runtime cache | network:runtime_cache:read, :write, :revalidate |
| AI Gateway | network:ai_gateway:chat, :models, :usage:read, :budgets:read, :budgets:write, :policies:read, :policies:write |
Un-namespaced forms such as applications:write and api_keys:delete predate the product namespaces. They are still accepted and map one to one onto the canonical names. Write the canonical form in anything new.
A scope is not an entitlement
Holding network:applications:write in a token does not mean the bearer may write to a given application. Entitlement can change while a token is still valid, so every route re-checks organization and application access on every request. Plan for a 403 from a token that was fine a minute ago.
Five scopes go further and are checked before the token is even issued: network:ai_gateway:usage:read, :budgets:read, :budgets:write, :policies:read, and :policies:write. Your client must be bound to a Gigadrive Network application, and the signed-in user must have access to that application's organization. Requesting one from an unbound client fails the whole authorization with invalid_scope, rather than quietly dropping the scope.
That is why the Gigadrive CLI leaves those five out of its login scopes. A first-party tool that is not bound to one application cannot ask for them.