Cloudflare has introduced OAuth scope customization, a change to its OAuth consent flow that lets users approve a narrower set of permissions than an application originally requested. The update addresses a gap that has existed since Cloudflare opened up third-party OAuth app creation in June, a period in which developers have built thousands of apps and logged more than a million authorizations.
Previously, an OAuth client could request a subset of its configured scopes, but once that request reached the consent screen, users had only two options: approve the entire request or deny it outright. Cloudflare says this became a real problem as its permission model grew more granular to support SaaS integrations, internal tools, CLIs, and AI agents. MCP servers were cited as a common case where an application requests broad access because an agent could theoretically use all of it, even though most users would only want to grant a fraction of those permissions.
How scope customization works
Developers configuring an OAuth client can now mark individual scopes as required or optional. At authorization time, users can deselect any optional scopes from the request, and the resulting access token will only include the scopes actually consented to. If a client does not mark any scopes as optional, the consent screen behaves exactly as it does today, so existing integrations are unaffected by default.
Cloudflare built this on top of an existing allowance in the OAuth specification that lets authorization servers grant a narrower scope set than what was requested.
- Required and optional scopes are evaluated only against the scopes requested in a specific authorization flow, not the client’s full configured scope list
- If a client requests only some of its configured scopes in a given flow, unrequested scopes are neither shown nor enforced
- The consent screen defaults to granting the full requested set unless the user opts to narrow it
Developers can configure optional scopes through Cloudflare’s API by adding an optional_scopes field alongside the standard scopes list when creating an OAuth client.
What this means for developers
Because users can now approve a partial grant, Cloudflare is advising developers to check the actual granted scope set after exchanging an authorization code, rather than assuming the full requested set was approved. Applications and agents that can operate gracefully within a reduced permission set, and that request only what they truly need, are more likely to earn user trust. For hosting professionals and site owners who rely on Cloudflare-integrated tools or agents, this update means finer-grained control over what third-party apps can actually do with an account, without needing custom consent screens built by each individual developer.