internal/auth/jwt.go

@@ -165,6 +165,20 @@ func (v *Validator) CheckPermissions(claims jwt.MapClaims, required ...string) b
 		}
 	}
 
+	// Fall back to scope claim (for client_credentials tokens)
+	// Authentik client_credentials tokens carry capabilities as space-separated scopes
+	if scopeIface, ok := claims["scope"]; ok {
+		if scopeStr, ok := scopeIface.(string); ok {
+			for _, s := range strings.Split(scopeStr, " ") {
+				for _, req := range required {
+					if s == req {
+						return true
+					}
+				}
+			}
+		}
+	}
+
 	return false
 }