Cloudflare Adds Optional OAuth Scopes, Letting Developers Mark What Users May Decline

Cloudflare has added optional OAuth scopes, letting client owners mark which permissions users may deselect at consent. The company names MCP servers as the motivating case, since agents request the union of everything they might do. Partial consent exists elsewhere, but developer control over which scopes are droppable does not.

By Steef-Jan Wiggers