SECURITY Signal 75
Cloudflare's OAuth clients can now flag scopes as optional for user-selectable consent
↗
Cloudflare added an `optional_scopes` field that lets developers mark permissions users may decline during OAuth consent.
Engineers can reduce consent friction for agents that need a wide permission set by allowing users to drop non-essential scopes. Applications must now handle tokens that contain fewer scopes than requested, otherwise calls to dropped permissions will fail.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Developers specify optional permissions with an `optional_scopes` array alongside required scopes.
During consent, users can deselect optional scopes, receiving an access token that only includes granted scopes.
Applications must inspect the token’s `scope` claim at runtime and degrade features when optional scopes are missing.
THE READ
What the cluster adds up to.
Cloudflare introduced an `optional_scopes` array in OAuth client configuration, separate from the existing `scopes` list. Required scopes remain mandatory, while any scope listed in `optional_scopes` may be omitted by the user on the consent screen. This change targets use cases such as MCP servers that previously had to request the union of all possible permissions.
When a user deselects an optional scope, the authorization server issues a token whose `scp` claim contains only the scopes the user approved. The consent UI now shows checkboxes for each optional permission, allowing granular consent instead of an all-or-nothing decision. Required scopes continue to be enforced, so a user cannot remove permissions the application truly needs.
For developers, the new behavior invalidates the assumption that a successful token grant includes every scope the client requested. Code must now read the `scope` parameter in the token response and conditionally enable or disable functionality based on which optional scopes were granted. Cloudflare advises degrading features gracefully rather than allowing authorization errors to surface to end users.
Clients that do not define `optional_scopes` retain the previous full-grant behavior, so existing integrations are unaffected unless they opt in. This backward compatibility means operators can adopt the feature incrementally, testing optional scopes on a per-client basis. The change does not require any modification to the OAuth protocol itself; it leverages RFC 6749’s allowance for narrower tokens.
While partial consent is offered by other providers such as GitHub, Google, and Microsoft Entra, Cloudflare is the first to give developers explicit control over which permissions may be dropped. This developer-level control helps agents avoid over-privileged requests that cause users to abandon consent. By surfacing the optional-scope choice, Cloudflare aims to improve user trust and reduce friction for complex integrations.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER