Scopes

Scopes are PERMISSIONS the client requests:

scope=read:email read:profile write:posts

The user sees them on the consent screen. They can approve all or none (most providers don't allow partial approval).

Conventional scope syntax:

• <resource>:<action> — read:email, write:gist, delete:repo
• Hierarchical: user, user:email, user:read, user:write
• Provider-specific: GitHub uses words; Google uses URLs (https://www.googleapis.com/auth/userinfo.email)

OIDC reserved scopes:

• openid — REQUIRED for OIDC; signals identity assertion
• profile — name, picture, etc.
• email — email + email_verified

Defining scopes for YOUR auth server:

1. Start MINIMAL. Apps can request more later.
2. Use clear names. Users will see them.
3. Group meaningfully. read:everything is too broad.
4. Document in your docs.

Scope creep is real: an app asking for "everything" is suspicious. Modern OAuth UX shows scope diffs prominently — "this app wants 5 NEW permissions".

When tokens are returned, the actual granted scopes are in the response (might be SUBSET of requested if user denied some).