تحديد نطاق ما يمكن للرمز المميّز تنفيذه

A valid token should not unlock everything. Scopes let a token carry only the specific permissions its holder actually needs. 🎯

A scope is a named permission, like read or write. Tokens are issued with a set of scopes describing what they may do.

Follow the principle of least privilege: grant the smallest set of scopes that gets the job done, and nothing extra.

When OAuth issues a token, the granted scopes are recorded with it. The server can read them to decide what to allow.

Before running a sensitive tool, confirm the token includes the required scope. If it is missing, refuse the call.

Separate a read scope from a write scope so a token meant only to look at data cannot quietly modify it.

You can scope access tool by tool, exposing a safe calculator to everyone while gating a delete tool behind a stricter scope.

Scopes can bound which resources a token sees, like one project folder, not every file the server can reach.

A request with a valid token but the wrong scope is authenticated yet not allowed, so the right answer is 403 Forbidden.

Keep a record of which tokens hold which scopes. An audit trail makes it clear who could do what if something goes wrong.

Review scopes regularly and revoke ones no longer needed. Narrowing permissions steadily shrinks your attack surface.

Pick the safest design choice.

Scopes turn one token into a precise key. Grant the least needed, check per tool, and answer 403 when a scope is missing. 🗝️