{
  "id": 9092330,
  "title": "OAuth scopes are not your app's authorization model",
  "url": "https://urgent.news/2026/09/22/oauth-scopes-are-not-your-apps-authorization-model",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-22T05:36:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/authbyexample1/oauth-scopes-are-not-your-apps-authorization-model-ak5"
  },
  "original_language": "en",
  "account": null,
  "summary": "OAuth scopes answer: \"what APIs may this token call?\" They do not answer: \"may this user read this document?\" A token with documents:read can still be used against every document ID the holder can guess, unless your API binds subject + action + resource on every request. Treat scopes as a coarse gate on the credential. Keep resource-level authorization inside your app — RBAC/ReBAC/ABAC checks…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}