For sign-in through OpenID Connect, openid is the essential scope. Add profile or email only when the application needs those additional claims; do not request unrelated API permissions for a sign-in-only flow. The protocol-level scope value might be openid profile email, but the available Waaseyaa documentation does not establish the client-side setting or code path for configuring it.
Which scopes are needed for sign-in only?
OpenID Connect (OIDC) adds an identity layer to OAuth 2.0. As the OpenID Connect Core 1.0 specification puts it, “OpenID Connect implements authentication as an extension to the OAuth 2.0 authorization process.” The openid scope identifies an authorization request as an OIDC request.
As an Amazon Associate I earn from qualifying purchases.
| Scope | When to request it |
|---|---|
openid |
For an OIDC identity request. Use this when the application needs a stable OIDC identity and no additional standard identity claims. |
profile |
Add when the application needs the optional profile claims defined by OIDC. |
email |
Add when the application needs the optional email claims defined by OIDC. |
address |
Another optional OIDC claim scope; request it only if the application needs address claims. |
phone |
Another optional OIDC claim scope; request it only if the application needs phone claims. |
OIDC scope names are case-sensitive and the scope list is space-delimited. For example, openid profile email is a protocol-level value for an application needing both profile and email claims. It is not verified Waaseyaa configuration syntax. Scope availability and returned claims can also depend on the identity provider and its policies; the standard scope names are not proof that a particular deployment accepts or returns every claim.
Keep identity scopes separate from API permissions
Identity claims answer questions such as who signed in and which requested user attributes the provider can return. Resource scopes instead authorize access to an API or other user data. A sign-in-only request should not include resource scopes simply because the application may use those APIs elsewhere; request each permission only when that separate feature needs it.
Google, for example, classifies openid, profile, and email as authentication-only scopes in its own environment. Its documentation suggests considering Sign In With Google and an ID Token when those are the only scopes a Google-integrated application needs. This is Google-specific guidance, not a Waaseyaa requirement or a statement about what a Waaseyaa issuer accepts. See Google’s OAuth 2.0 scopes documentation.
How Waaseyaa’s packages fit together
The Packagist listing for waaseyaa/oidc describes it as the OIDC issuer for the Waaseyaa ecosystem. It says issuer primitives are used by a dedicated identity-provider app, while consumer applications federate through waaseyaa/oauth-provider and its GenericOidcProvider. The listing says consumer apps do not install the issuer package.
Rank #2
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
The issuer package listing describes authorization, token, UserInfo and discovery endpoints, JWKS, revocation, RP-initiated logout, and signing-key storage and rotation. These facts describe the issuer package’s role; they do not establish the client-side setting that adds scopes to a consumer’s authorization request.
Recommended Free Tools
Where to configure the scope in a Waaseyaa app
The available package listing does not show whether a consumer configures scopes in a file, a provider constructor, an authorization-request builder, or another layer. It also does not document a Waaseyaa option name or code example for this setting. Do not assume that a generic OAuth library’s scopes key or an example from another provider applies.
Rank #3
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
For the exact implementation, check the documentation and source for the installed version of the consumer integration—particularly the component that builds the authorization request—and confirm that it passes the intended scope value. The relevant component may differ from the issuer package: the listing identifies waaseyaa/oidc as issuer-side and waaseyaa/oauth-provider as the consumer federation path. Verify the installed versions rather than inferring a setting from the package roles.
Check the rest of the authorization request
Scope choice is only one part of a sound authorization request. Google’s web-server OAuth guidance provides provider-specific examples of request hygiene; the precise defaults and supported parameters for a Waaseyaa deployment need to be checked against its consumer and issuer versions.
Rank #4
- Tamper Resistant Star Key Set Crafted with premium chrome vanadium steel, and each star tool folds neatly into the handle for quick, easy access.
- Details - The handle is engraved with size for quick identification with drilled tips to allow use.
- Portable - Keys fold compact for easy storage, Drilled tips allow use on tamper resistant security screws.
- Size:Full Size T-6, T-7, T-8, T-9, T-10, T-15 T-20, T-25, T-27 and T-30.
- And with 10 total star sizes able to match nearly all standard tamper resistant security screws on the market.
- Redirect URI: For Google’s web-server implementation, the redirect URI must exactly match an authorized URI, including scheme, letter case, and trailing slash. Treat that as a Google-specific rule, not proof of Waaseyaa behavior.
state: Use it to correlate the authorization response with the initiating request and help mitigate cross-site request forgery (CSRF).- Offline access: Google documents
access_type=offlinefor applications that need to refresh access while the user is absent; its authorization-code flow can return refresh tokens in that case. Offline access is separate from identity scopes, so do not add it merely to sign a user in.
These request examples are documented in Google’s web-server OAuth 2.0 documentation. Check the actual provider’s rules before applying them to Waaseyaa.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallA practical decision sequence
- List the identity data the sign-in experience needs. If the application needs only an OIDC identity, the protocol-level scope to consider is
openid. Addprofileoremailonly for the corresponding claims the experience uses. - Separate API access from sign-in. Identify any resource permissions needed for a distinct feature and keep them out of a sign-in-only request unless that flow genuinely needs them.
- Decide whether offline refresh is necessary. Request offline access only when the application must obtain refreshed access while the user is absent, and confirm the provider’s implementation.
- Find the request owner in the deployed version. Determine which consumer integration builds the authorization request, then verify its documented scope configuration and accepted values. The package listing alone does not answer this.
- Validate the round trip. Confirm that the authorization request contains only intended scopes, the callback matches the provider’s registered redirect requirements, and the response is correlated using
state.
What the package listing does—and does not—tell you
The Packagist entry lists v0.1.0-alpha.271, published on 2026-07-20. At the 2026 listing snapshot, Packagist showed 2,696 installs and 4 dependents. Those are dynamic registry counters, not measures of active production deployments, adoption, or successful sign-ins. The listing’s package and architecture details do not document the client-side scope configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
