From all-or-nothing to task-based OAuth consent

Cloudflare reports over a million OAuth authorizations since June, with developers creating thousands of third-party apps that rely on delegated access without handling user credentials. OAuth traditionally uses scopes to define access levels, but the consent screen previously required users to approve all requested scopes or deny entirely, limiting flexibility. The new feature enables developers to mark specific scopes as optional, allowing users to grant a narrower subset of permissions during authorization while maintaining required scopes for core functionality. This addresses scenarios where applications request broad permissions, such as MCP servers, which users may not fully trust with extensive access rights.

The implementation builds on OAuth’s existing flexibility, where authorization servers can grant fewer scopes than requested, but Cloudflare has refined this to streamline the user experience. Required and optional scopes are evaluated based on the specific authorization request, not the full client configuration, ensuring the consent screen remains focused on the task at hand. For example, a client configured with four scopes can request all four, but users may opt out of optional ones like workers-kv-storage.write and zone.read, while required scopes like user-details.read remain enforced. This prevents unnecessary exposure of unrelated permissions during authorization.

Developers must now verify the granted scope set after exchanging the authorization code, as the access token will only contain the scopes the user explicitly consented to. This change encourages developers to request only necessary permissions and mark the rest as optional, signaling to users that the app respects their access decisions. The feature maintains backward compatibility, as existing OAuth clients retain their current behavior unless they opt into scope customization during configuration.

Cloudflare plans to expand its account and zone-level role surface to cover nearly every product, providing more granular API token roles, account membership options, and OAuth scopes. The introduction of optional scopes is part of a broader effort to create a more flexible and trustworthy consent experience, empowering both developers and users to better restrict access. The feature was developed with contributions from interns Miller Vargas and José Enrique Rodriguez, who are recognized for their high-impact work in enhancing Cloudflare’s OAuth ecosystem.