Scopes and consent

OAuth 2.0 Course · lesson 6 of 13 · 4 min read

Scopes limit what a token can do - and asking for too many loses you users.

Open this lesson in the learning hub

Key points

  • A scope is a named permission the client requests: orders.read, profile.
  • The consent screen shows the user exactly what they are approving, in these terms.
  • The issued token carries only the granted scopes - the user may approve fewer than were asked for.
  • The resource server must enforce scope; a token with orders.read must not be able to write.
  • Ask for the minimum, and ask incrementally - request extra scopes when the feature is first used.

Every extra scope is a reason for the user to say no - request the minimum, later rather than sooner.

Choosing a grant type Access tokens and refresh tokens

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth 2.0 Course course, and every lesson in it is listed on the OAuth 2.0 Course contents page.