OAuth scopes

A scope is a string — read, orders:write, openid — that names a slice of access. A client asks for the scopes it needs, the user or policy grants some or all of them, and the issued token carries the granted set. Resource servers check the token's scopes before acting, so a token minted for reading cannot be used to delete.

How it works

Scopes travel in the scope parameter of the authorization or token request as a space-separated list, and come back in the token response — possibly narrower than requested. A JWT access token usually carries them in a scope or scp claim; an opaque token's scopes are found through introspection.

The misconception

That a token has the scopes you asked for. The server may grant fewer, and a client that assumes otherwise fails later, far from the cause. Read the scope field in the token response, and test what happens when a call needs a scope the token lacks.

Try it here

The token response from POST /auth/v1/oauth/token states the granted scope — read for client credentials, read write for the authorization code flow — and POST /identity/v1/introspect reports the scope of an Identity API token.

Sources

Other terms

OAuth 2.0 — The standard framework for letting an application get a limited access token, instead of handling the user's password.
JWT (JSON Web Token) — A compact format for claims, represented as a signed JWS or encrypted JWE.
JWKS — A JSON Web Key Set — the public keys an issuer publishes so that anyone can verify the tokens it signs.
Bearer token — A credential where possession alone grants access — whoever holds it can use it.
Refresh token — A long-lived credential used only to obtain new short-lived access tokens, without asking the user to log in again.
PKCE — Proof Key for Code Exchange — a one-time secret that stops a stolen OAuth authorization code from being redeemed by anyone else.

All glossary terms · Testing techniques · All 39 mock REST APIs

Last updated 16 October 2026