Cloudflare announced the addition of OAuth scope customization, a feature that allows owners of third-party OAuth applications to designate mandatory and optional permissions. As a result, users can revoke optional permissions during the consent screen and grant the application a narrower range of access instead of choosing between accepting all requested permissions or rejecting the request entirely.
The move comes after developers created thousands of third-party OAuth applications on Cloudflare since June, with more than one million authorization operations recorded since then. These applications are used for software-as-a-service integrations, internal tools, command-line interfaces, and software agents.
From Broad Consent to Task-Related Permissions
Cloudflare OAuth previously allowed an application to request a subset of the scopes configured for it, but users could not narrow that set from the consent screen itself. If an application requested more permissions than a user considered appropriate, the only options were to grant the entire request or reject it.
Cloudflare explains that MCP servers represent a clear use case for this problem. An MCP server may request a broad set of permissions because an agent might theoretically need all of them, while the user may not necessarily want to grant the agent that level of access. Before the feature was launched, developers had to build a custom scope-selection screen before redirecting the user to the Cloudflare consent flow.
How Do Optional Scopes Work?
- When configuring an OAuth client, a developer can designate specific scopes as mandatory or optional.
- The user can deselect optional scopes within the requested set of permissions during the current authorization operation.
- The default experience remains unchanged if the client does not enable optional scopes, and the consent screen grants the full requested set when no optional scope is deselected.
The important point is that evaluation is based on the scopes requested by the application in a specific authorization flow, not on all scopes configured for the client. If the client includes user-details.read, workers-scripts.write, workers-kv-storage.write, and zone.read, with the latter two designated as optional, a request for all four scopes allows the user to revoke only the latter two.
If the client later requests only workers-scripts.write and zone.read, only those two scopes will be evaluated in that operation. The other scopes will not appear or be enforced because they were not part of the current request. This helps keep the consent screen focused on the required task instead of displaying all the capabilities the application might request in the future.
What Changes Practically for Developers?
When a user revokes some optional scopes and completes authorization, the resulting access token will contain only the permissions the user approved. Therefore, developers must inspect the set of granted scopes after exchanging the authorization code instead of assuming that the application received the entire requested set.
This means that applications, particularly software agents, need to handle partial permission grants smoothly. Requesting the minimum necessary access and making additional permissions optional also makes it clear to users that the application respects their decisions about access boundaries.
Expansion to Cloudflare Products
Cloudflare said it would expand account- and zone-level role scopes over the following weeks to cover nearly all of its products, including more API token roles, account membership options, and OAuth scopes. Developers can get started through the Third Party OAuth documentation or from the OAuth Applications page in the dashboard.
The company said the feature was developed with the help of 1,111 interns, commending the contributions of Miller Vargas and José Enrique Rodriguez. According to the article, Vargas studies computer science and mathematics at the University of Texas - Austin, while Rodriguez studies engineering, data intelligence, and cybersecurity at Universidad Panamericana.