Skip to main content
When client presents an access token to a resource server, that token is composed of one or more scopes. Scopes are strings that indicate the specific resources that the token bearer (that is, the client) wants to access or the actions the that client wants to perform against those resources (for example, read or retrieve a user’s email address). A scope is like a keyword that maps to one or more individual pieces of data in the resource server, and those pieces are called claims. When a client initiates a grant flow, it requests a list of certain scopes from the resource owner, ideally in plain language. The resource owner can limit scopes in the actual granted access token as they see fit. OAuth 2.0 does not define a universal set of standard scopes. Therefore, each resource server might have own particular scopes (and each scope maps to its own particular claims). However, OIDC, the extension to OAuth.2.0, does define a set of standard scopes. This standardization helps to streamline and organize the transfer of user authentication of users across multiple systems on the internet. Parent topic:OAuth 2.0 and OpenID Connect