--- title: "From all-or-nothing to task-based OAuth consent" url: https://daily.dev/posts/from-all-or-nothing-to-task-based-oauth-consent-t9bk34fln source_url: https://blog.cloudflare.com/task-based-oauth-consent type: article source: "Cloudflare" published: 2026-08-20T17:06:44.227Z updated: 2026-08-20T17:07:11.056Z tags: ["architecture", "authentication", "mcp", "cloudflare", "oauth"] reading_time: 6 upvotes: 2 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From all-or-nothing to task-based OAuth consent **[Cloudflare](https://daily.dev/sources/cloudflare)** · 6 min read · 2 upvotes · 0 comments ## Summary Cloudflare has launched OAuth scope customization, letting developers mark specific OAuth scopes as optional when configuring an OAuth client. Users can then deselect optional scopes at authorization time, narrowing access without an all-or-nothing consent screen. Required and optional scopes are evaluated only against the scopes requested in a given authorization flow, not the client's full configured set. Developers must check the granted scope set after code exchange rather than assuming the full requested scopes were approved, and Cloudflare plans to expand role and scope coverage across nearly all its products in coming weeks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I mark OAuth scopes as optional when creating a Cloudflare OAuth client? Include an optional_scopes array alongside the scopes array when creating the client via the Cloudflare API. Any scope listed in optional_scopes can be deselected by the user on the consent screen at authorization time, while scopes left out of that array remain required whenever they are part of the requested set. _Developers wiring up Cloudflare OAuth apps can track these API changes as they build consent flows on daily.dev._ ### Does an OAuth client always get the full set of scopes it was granted originally in Cloudflare's new optional scope model? No, if a user deselects any optional scopes during consent, the resulting access token only contains the scopes they approved. Developers need to check the granted scope set after exchanging the authorization code rather than assuming the originally requested scopes were all approved, and apps should degrade gracefully when given a narrower grant. _Teams building agents on partial OAuth grants can follow this pattern on daily.dev before it bites them in production._ ### How does Cloudflare decide which OAuth scopes to show as optional on the consent screen for a given login? Required and optional status is evaluated only against the scopes actually requested in that specific authorization flow, not against every scope configured on the client. So if a client is configured with four scopes but only requests two of them in a given flow, only those two are shown or enforced on the consent screen, regardless of what else the client could theoretically request. _daily.dev helps developers stay current on OAuth scoping details before wiring up consent screens._ ## Similar posts on daily.dev - [Unlocking the Cloudflare app ecosystem with OAuth for all](https://daily.dev/posts/unlocking-the-cloudflare-app-ecosystem-with-oauth-for-all-tkqsqak0n) · Cloudflare · 10 upvotes · 0 comments - [Securing non-human identities: automated revocation, OAuth, and scoped permissions](https://daily.dev/posts/securing-non-human-identities-automated-revocation-oauth-and-scoped-permissions-arfnwgtex) · Cloudflare · 1 upvotes · 0 comments --- Tags: [#architecture](https://daily.dev/tags/architecture), [#authentication](https://daily.dev/tags/authentication), [#mcp](https://daily.dev/tags/mcp), [#cloudflare](https://daily.dev/tags/cloudflare), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/from-all-or-nothing-to-task-based-oauth-consent-t9bk34fln)