Cloudflare OAuth scopes: now you can split required from optional!

Hi, it's me! I found a small-but-mighty Cloudflare OAuth update today, so let's take a look!

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog announced the general availability of Optional OAuth Scopes. OAuth client developers can now classify the scopes they configure as either required or optional. By default, all configured scopes stay required, just like before.

The story so far

Until now, every scope an app requested through Cloudflare's OAuth was treated as required. That meant users only had one choice on the consent screen: approve everything, or approve nothing.

What changes

When developers mark scopes as required or optional while setting up an OAuth client, users can now approve the required scopes as before while individually declining the optional ones. That makes it much easier to apply least-privilege access to apps, CLIs, and workloads. Optional scopes are selected by default on the consent screen.

Dive Deep

There are a few more improvements around the consent screen worth knowing about.

• Templates: "Read Only" and "Full Access" templates were added so scope selection is faster
• Search: users can now search for scopes right on the consent screen

Everything is configured from the Cloudflare dashboard. Existing OAuth clients aren't affected — only the scopes a developer explicitly marks as optional become individually declinable, so current app behavior stays the same.

Wrap-up

• OAuth scopes can now be classified as required or optional (GA)
• Previously, every scope was required and consent was all-or-nothing
• Users can individually decline optional scopes on the consent screen
• "Read Only" and "Full Access" templates plus scope search were also added

If you build or run OAuth clients on Cloudflare, this is worth a look!