Cloudflare has added optional OAuth scopes, allowing users to remove selected permissions from an application’s request instead of accepting or rejecting the entire set. Developers decide which scopes may be dropped, while genuinely necessary permissions can remain required.
The change targets a problem created by broad agent integrations. An MCP server may request every permission an agent could ever need even when a particular user wants only read access. Cloudflare’s example pattern is to require access to data the agent must inspect while making write powers optional. Users can then withhold actions such as changing prices or issuing refunds without blocking a useful read-only workflow.
Applications must now check the scope returned after exchanging the authorization code rather than assume successful consent grants everything requested. If a write scope is absent, Cloudflare recommends disabling that function and explaining the limitation instead of failing later with an authorization error. Existing clients keep their current all-or-nothing behavior unless developers opt in, so the security benefit depends on services marking optional powers carefully and handling reduced access cleanly.