From all-or-nothing to task-based OAuth consent

Summary

Cloudflare introduced OAuth scope customization to replace all-or-nothing consent flows for third-party applications. Previously, users had to approve every requested scope or deny access completely, compelling developers of tools like MCP servers to construct custom pre-consent selection interfaces. With the new feature, developers can designate specific permissions as optional alongside required scopes when configuring an OAuth client. During authorization, users can deselect these optional scopes, while unrequested client scopes remain hidden to maintain task-specific consent screens. Because resulting access tokens contain only the granted subset of permissions, client applications must inspect returned scopes after code exchange rather than assuming full authorization.

Takeaways

1. 1

   Scope customization allows developers to configure optional scopes on OAuth clients, letting users deselect specific permissions during authorization while keeping required scopes mandatory.

2. 2

   Required and optional scopes are evaluated strictly against the scopes requested in a specific authorization flow, not against all scopes configured on the client.

3. 3

   Access tokens generated after authorization contain only the scopes granted by the user, requiring applications to verify returned permissions rather than assuming full approval.