On August 20, 2026, Cloudflare released optional OAuth scopes so users can choose exactly which permissions to grant for a specific task. If you connect AI agents or SaaS tools to your accounts, you no longer have to accept an all-or-nothing approval screen.
According to the Cloudflare Blog, an OAuth client can now label its permissions as required or optional. During login, a user can deselect the optional boxes. The generated token then receives only the permissions you approved. Existing applications keep their standard setup unless developers explicitly turn this feature on.
This changes the permission model.
Better control for AI agents and tools
Many modern tools, like Model Context Protocol (MCP) servers and command-line interfaces, ask for broad access because they support many jobs. But you might only want an agent to run one specific task today. With optional scopes, you can give the tool only the access it needs right now. Cloudflare says this model also helps internal tools and standard SaaS integrations.
Tokens become much more focused.
The numbers you shouldn’t verify alone
Cloudflare claims it has processed more than 1 million authorizations since June. That number comes directly from the company — nobody outside Cloudflare has independently measured adoption or verified these figures. Cloudflare also has not proven that this feature reduces real-world security breaches. A smaller token limits access, but your app must still handle partial permissions without crashing.
What developers need to handle
This update shifts real work to app developers. In the past, an app could assume it received every permission it asked for. Now, developers must inspect the token after authorization to see which scopes were granted. If a user turns off an optional scope, the app must show a helpful message instead of failing silently.
Apps must handle missing permissions.
How you can test it today
If you build or maintain integrations, test this workflow in a staging environment:
- Create a test OAuth client with two required scopes and two optional scopes.
- Request all four scopes, but uncheck the two optional ones on the consent screen.
- Exchange the authorization code and inspect the final token payload.
- Call your APIs to confirm that the server correctly blocks disabled actions without treating the whole token as invalid.
- Test how your AI agents and MCP servers report denied capabilities to users.
Doing these checks now will ensure your tools stay stable when users choose to protect their data.