Cloudflare is introducing OAuth scope customization that lets clients mark specific scopes as optional, enabling users to grant a narrower subset of an application's requested access at authorization time. The company notes that OAuth already supports granting a subset of an app’s configured scopes, but the new feature adds a way to tailor consent more precisely within a given authorization flow.
- Clients can request all configured scopes, but optional scopes can be deselected by the user during consent.
- If no optional scopes are requested, the consent flow remains unchanged.
WHAT CHANGED
The change adds a mechanism for developers to designate certain scopes as optional when configuring an OAuth client. At authorization time, users can deselect these optional scopes from the requested set, while required scopes remain enforced. TechStaged has also covered Google adds broader personalization controls across Search, Discover, and News with a publishers-backed “Preferred Sources” feature.
- Optional scopes are evaluated against the scopes requested in a specific authorization flow, not against the entire client configuration.
- This preserves the existing behavior if optional scopes are not opted into.
HOW SCOPE CUSTOMIZATION WORKS
When a client initiates an authorization flow, the system evaluates the requested scopes against those marked as required or optional. If optional scopes are present in the request, the user may choose to grant only the subset they approve. Regardless of the selection, the access token issued will reflect the scopes actually granted by the user.
- If the authorization request includes multiple scopes and only some are optional, only those optional scopes appear as choices.
- The consent screen focuses on the specific authorization task rather than a broad, all-encompassing permission set.
A PRACTICAL EXAMPLE
Cloudflare cites MCP servers as an example: such servers may request a broad permission set in theory, but users typically do not want an agent to have that level of access. With scope customization, optional permissions can be withheld by the user without forcing the app to operate under a wider grant.
- The model supports partial grants aligned with the user’s needs for a given task flow.
IMPACT AND IMPLICATIONS
The feature is designed to improve security by enabling more granular approvals while avoiding a long, fill-in checklist on consent screens. It also helps applications operate within narrower grants when possible, reducing risk if an app is compromised or misused.
- Security-conscious users gain more control over what they approve.
- Developers must validate the granted scope set after exchanging an authorization code, as it may differ from the initially requested set.
WHAT HAPPENS NEXT
Cloudflare notes that it will expand its account and zone-level role surface to cover nearly every product in the coming weeks, increasing the range of OAuth scopes and token roles available to customers.
- More API token roles, account membership options, and OAuth scopes are expected to be added.
GETTING STARTED
Developers can begin using Third Party OAuth by configuring scopes as usual and opting into optional scopes. Documentation and the OAuth apps page in the Cloudflare dashboard provide guidance on creating and managing OAuth clients.
- Check the documentation for how to configure required and optional scopes.
- Visit the OAuth apps page in the dashboard to create your first OAuth app.
RELATED COVERAGE
- Google adds broader personalization controls across Search, Discover, and News with a publishers-backed “Preferred Sources” feature
- Google Arts & Culture unveils United Parks of America, weaving one digital hub for 60 national parks and AI-powered history storytelling
- GitHub Code Quality enablement changes now logged in audit history
- Google AI Max gains new testing and planning tools to map campaign ROI
- Software articles
SOURCES
- Cloudflare Blog: From all-or-nothing to task-based OAuth consent Published · Primary source
