OAuth scopes can limit which API operations a token may access, but they do not automatically grant access to a particular record. An API must validate the token, check its scope and resource context, then make its own decision about whether the authenticated user or client may perform the requested action on the specific object.
What an OAuth scope authorizes
An OAuth scope is an authorization-server-defined access range associated with a token. An API might use a scope such as read or write to decide whether a token is eligible to call an endpoint or use a category of functionality. OAuth does not define a universal registry or fixed meaning for those strings; their meaning comes from the authorization server and the system using them. RFC 6749 and RFC 6750 describe scopes as values associated with access ranges.
Scopes do have authorization value: the resource server must check that the token’s granted scope covers the requested API resource. But passing that check only establishes that the token is eligible for the operation under the scope policy. It does not establish that the principal may act on every object reachable through that API.
Why a scope is not permission to a specific object
A scope such as read cannot, by itself, answer whether Alice may read invoice 123, whether a client may modify a particular tenant’s account, or whether a user may open another user’s photo. Those decisions depend on the authenticated principal, the target object, the requested action, and the application’s policy—for example, ownership, tenant membership, delegated access, or role.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute#1 Best Overall
Confusing these checks creates an insecure direct object reference or broken object-level authorization risk: a caller changes an identifier in a URL or request body and reaches an object the caller should not control. A valid token and broad scope do not make a client-supplied object identifier trustworthy. The API must make the object-level decision itself.
What the API should check on every request
Use a request-time authorization sequence that keeps token eligibility separate from application policy:
Rank #2
- Validate the access token according to the system’s token format and trust rules.
- Verify that the token is intended for this API or resource context, and that its granted scope covers the requested operation.
- Identify the authenticated user or client from the validated token.
- Load the target object using the request’s identifier, without treating that identifier as proof of access.
- Evaluate the application’s policy for this principal, this object, and this action; allow only if the policy permits it.
RFC 9700, the OAuth 2.0 Security Best Current Practice, says: “Additionally, access tokens SHOULD be restricted to certain resources and actions on resource servers or resources.” It also supports verifying on each request that a token applies to the particular resource and action. These token applicability checks strengthen authorization, but do not replace the application’s object-level policy. RFC 9700
Scopes, resource indicators, and authorization details
Different OAuth mechanisms can express different levels of intent. None removes the need for the resource server to enforce access:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Rank #3
| Mechanism | What it expresses | What the API still decides |
|---|---|---|
| OAuth scope | An authorization-server-defined access range, often associated with an API or class of operations. | Whether the token’s scope covers the operation and whether the principal may act on the requested object. |
| Resource Indicator | The target resource for which a token is requested, as defined by RFC 8707. | Whether the token is applicable to this resource and whether the principal is authorized for the specific object and action. |
| Rich Authorization Request (RAR) | Structured authorization details that can describe elements such as actions, locations, data types, and privileges, as defined by RFC 9396. | Whether the request’s details and the application’s policy permit this principal to perform this action on this object. |
Resource indicators and RAR can make authorization requests more precise. They communicate intent; they are not automatic proof that the API has checked ownership, tenant boundaries, or another object-level rule.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to request scopes safely
Ask for the smallest scopes needed for the feature the user is using, and request additional scopes in context when a feature requires them. Google recommends this approach in its provider-specific OAuth best practices. Google’s scope names and rules are examples for Google APIs, not a universal catalog or requirements for every OAuth provider.
Quick Recap
Best Value
Rank #4
- API Security in Action
- Manning Publications
- ABIS BOOK
- Define scope meanings explicitly in your authorization server and API documentation.
- Check granted scopes at the resource server rather than assuming a requested scope was granted.
- Keep object-level checks in the API, close to the data operation, and test attempts to access objects belonging to other users or tenants.
- Use resource- and action-specific token restrictions where appropriate, while retaining the final principal-object-action policy check.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
