Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
You can request only scope values supported by the authorization server for the API you want to use. OAuth 2.0 does not provide a universal list of scopes: the server defines each scope’s exact string and meaning, and it may grant less access than your app requested. Check the API’s documentation for the operation or feature you need, request the smallest useful set, then inspect the scopes actually granted.
What an OAuth scope is—and who decides which ones exist
A scope is a string an OAuth client includes in an authorization request to describe the access it is asking for. The authorization server defines which strings it recognizes and what they mean. As RFC 6749, Section 3.3, puts it: “The strings are defined by the authorization server.” RFC 6750, Section 3, likewise says there is no centralized registry of allowed scope values.
That means there is no valid universal answer such as “read, write, and admin are the OAuth scopes.” Those words may occur in a provider’s permission system, but their existence and effect depend on that provider. Another service may use entirely different strings, or represent permissions through a different mechanism.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Scope tokens are case-sensitive and are separated by spaces in an OAuth request. Treat the documented value as an exact identifier: do not change its capitalization, substitute a similarly named value from another product, or assume that a label’s meaning is self-evident. A scope that looks plausible is not necessarily supported or appropriate for the endpoint you intend to call.
#1 Best Overall
How to find the right scopes for an API operation
- Name the feature and operation. Identify the exact API, endpoint, or app feature and the account context in which it will run. A feature that reads a profile may need different access from one that changes organization settings.
- Use that operation’s official documentation. Find the provider’s permission or scope requirements for the specific method. Do not choose a scope based only on its name or copy one from a different provider, API, or application model.
- Choose the narrowest useful access. Request only what the feature needs. If the provider supports incremental authorization, request an additional permission when the user invokes the feature that needs it, rather than asking for every possible permission at first launch. Google explicitly recommends incremental authorization where appropriate; OAuth security guidance also favors limiting access to the intended resources and actions.
- Authorize, then inspect the result. Compare the granted scopes with the documented requirements for your feature. A request does not guarantee that every requested scope will be issued.
- Handle missing permissions deliberately. If the authorization result lacks a scope required for a feature, explain what is unavailable and how the user can authorize again if appropriate. Do not silently assume the missing access exists or enable an operation that depends on it.
For Google APIs, the API’s per-method documentation is the place to find required scopes. Google also advises developers to compare the scopes granted with those needed for app features. If protected-resource metadata is available, its scopes_supported value may advertise scopes the server supports, but it does not replace the operation’s documentation or the need to apply least privilege.
Requested scopes and granted scopes are not always the same
An authorization request expresses what the client wants; the authorization server decides what it will issue under its policies and the resource owner’s instructions. It may ignore some or all requested scope values, grant a narrower set, or reject the request. In particular, do not treat the scopes in your outgoing request as proof of the token’s actual authority.
Rank #2
RFC 6749 requires the authorization server to report the actual scope in its response when the issued scope differs from the requested scope. Check that response and use the result when deciding which features to expose. A provider may also map multiple requested strings to a different returned scope representation. Google documents this possibility for its APIs, so exact string comparison should follow the provider’s documented behavior rather than an assumption that request and response must match byte for byte.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteOperationally, keep a clear distinction between “requested” and “granted” permissions in your application logic and logs. The requested set helps explain the consent flow you initiated; the granted set is the information to use when evaluating whether a protected operation is supported. If access is partial, make the feature boundary visible instead of turning it into a confusing downstream API failure.
Rank #3
- Used Book in Good Condition
Scope is not the same as the resource or service
A scope describes requested access; a resource indicator identifies the service or protected resource where a token is intended to be used. RFC 8707 distinguishes these concepts. The authorization server determines which resource values it accepts under its configuration and policy, so a scope label alone should not be read as proof that a token is valid for every service.
Think of the authorization request as answering two different questions: what actions or permissions are being requested, and where the resulting token is meant to be used. Security guidance recommends constraining tokens to the intended resource and actions. Follow the API and authorization-server documentation for both rather than trying to use a scope string as a substitute for resource targeting.
Some APIs also support structured authorization requirements through authorization_details, defined by RFC 9396. It can be used alongside scope; the API defines how those requirements are combined and presented for consent. This is not a universal replacement for scopes, and clients should not invent their own interpretation of the structured data.
Provider examples: useful illustrations, not portable recipes
| Provider or model | What the example illustrates | What to check |
|---|---|---|
| Google APIs | Access-token requests accept one or more scope values, but the scope returned may differ from the one requested. Requirements are documented per API method. | Use the relevant method’s current documentation and inspect the authorization result. |
| GitHub OAuth Apps | Scopes are named permission groups. For example, user:email allows reading private email addresses. An admin:org token cannot give administrative access to someone who is not an organization owner. |
First identify whether the integration uses a GitHub OAuth App or a GitHub App. GitHub Apps use fine-grained permissions rather than OAuth App scopes. |
| Microsoft identity platform | The .default pattern refers to a resource and permissions configured for the application. For Microsoft Graph, an example is https://graph.microsoft.com/.default. |
Treat .default as a Microsoft convention and follow the current documentation for the target resource and application setup. |
These examples demonstrate why scope strings cannot be copied between providers. Even two permission names that look similar may have different breadth, prerequisites, or effects. Confirm the app model, resource, and operation before settling on a request.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and how to recover
- Guessing a scope from its name: a familiar word such as
readoradmindoes not establish that the server supports it or what access it grants. Find the exact value in documentation for the endpoint. - Copying a scope from another provider: there is no central registry or shared vocabulary. Replace the borrowed value with the target provider’s documented permission.
- Assuming requested access was granted: authorization policy can narrow the result. Inspect the actual scope returned and gate dependent features accordingly.
- Requesting every permission up front: broad requests may ask for more access than the user needs to grant immediately. Where supported, request additional access when the associated feature is used.
- Confusing an OAuth App with another app model: GitHub Apps, for example, use fine-grained permissions rather than OAuth App scopes. Verify the model before applying instructions.
- Treating a scope as proof of the token’s destination: scope and resource are distinct. Follow the server’s resource-targeting rules as well as its scope requirements.
- Assuming every API uses scopes alone: some APIs can combine scopes with structured authorization details. Use only the combination and interpretation specified by that API.
ScreenshotNeo for a separate developer task
ScreenshotNeo is a website screenshot API and MCP server for developers; it is a separate product category from OAuth scope documentation, not a source of OAuth permission strings. If you also need to capture a page while building a developer workflow, one GET request can return an image or PDF. Before capture, ScreenshotNeo accepts cookie or consent banners like a visitor and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each of those steps can be turned off. Bot checks or CAPTCHAs, blank pages, timeouts, failed loads, and cache hits are not billed, and responses report the page verdict and billing status in headers. Its MCP server provides take_screenshot, get_page_info, and capture_pdf tools for AI agents and MCP clients.
For example, this cURL request captures the Stripe home page as WebP; the documented API options and setup are in the ScreenshotNeo documentation.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpThe free plan includes 1,000 shots per month with no card. Paid plans start at $5 for 3,000 shots; yearly billing gives two months free, and every feature is on every plan. Learn about ScreenshotNeo or sign up for 1,000 free screenshots a month with no card.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
