From All-or-Nothing to Task-Based OAuth Consent

Since June, thousands of third-party OAuth apps have been created and over 1 million authorizations have taken place. To overcome the limitations of the existing all-or-nothing consent screen, Cloudflare has introduced OAuth scope customization.

Previously, users could not further refine the scope of permissions requested by an app; if an app requested excessive permissions, users could only approve or deny them entirely. In particular, agent-based apps such as MCP servers often request broad permissions because they can theoretically use all permissions, but most users tend not to consent to this.

The new feature allows developers to designate specific scopes as optional when configuring OAuth clients. At the time of authorization, users can deselect only the optional scopes among the requested permissions, thereby allowing a narrower range of access. This is built upon the OAuth specification's already-supported feature of "allowing a narrower set of scopes than requested."

The key behaviors are as follows:

• Required/Optional Distinction: Developers designate scopes as either required or optional.
• Request-Based Evaluation: The required/optional status is evaluated only for the scopes requested in the authorization flow.
• Default Behavior Retained: Existing clients with no optional scopes designated retain the same all-or-nothing experience as before.

When a user deselects optional scopes and completes authorization, the generated access token contains only the consented scopes. Developers must verify the actual permissions included in the token and implement logic that accounts for partial grants.