ST-2026-208 · Authentication & identity
Cloudflare OAuth clients gain optional scopes at General Availability
Cloudflare made Optional OAuth Scopes generally available on 20 August 2026, allowing OAuth client owners to classify configured scopes as required or optional and allowing users to decline optional scopes during consent.
Previous state
Configured OAuth client scopes were presented through an all-or-nothing consent boundary once requested; users could not selectively decline a subset of requested scopes during the consent step.
Current state
OAuth client owners can mark configured scopes as optional, while required scopes remain mandatory. Users can decline optional scopes on the consent screen; optional scopes are selected by default and all configured scopes remain required by default unless reclassified.
Affected users
Who needs to care
Developers and administrators configuring Cloudflare OAuth clients, and users authorizing those applications.
Required response
What to do
Review configured client scopes, mark only genuinely optional permissions as optional, and ensure applications tolerate a narrower granted scope set instead of assuming every requested optional scope was approved.
Evidence boundary
What the source does not prove
The source proves General Availability of optional scope classification and partial consent. It does not make existing required scopes optional automatically, and it does not mean every configured scope is shown in every authorization flow.
Lifecycle history
Dated event sequence
- Optional OAuth Scopes become generally available
Cloudflare announced required-versus-optional client scope classification and user-selectable optional consent.
Evidence ledger
First-party sources
- 01Cloudflare — Optional OAuth scopes
Official Cloudflare changelog · 2026-08-20
Open official source ↗