Cloudflare Adds Optional OAuth Scopes, Letting Developers Mark What Users May Decline

Cloudflare has introduced optional OAuth scopes, enabling users to select specific permissions during the consent screen. This feature addresses the issue faced by agents, which often require broad sets of permissions, causing users to decline an application's full request due to concerns over extensive access. By marking scopes as optional, developers can now request only the necessary permissions, allowing users to deselect any that are not required.

This change aims to provide a more granular consent process, improving user experience and reducing the risk of applications requesting unnecessary permissions. When a user declines an optional scope, the access token issued will only contain the granted permissions, prompting applications to adjust their functionality accordingly.

Cloudflare's approach emphasizes developer control over which permissions may be dropped, while still placing the decision in the user's hands during the consent process.