What is a scope in OAuth, and what does the user actually agree to on the consent screen?
A scope names a specific kind of access (for example "read profile and email", "post on my behalf"); on the consent screen the user approves exactly those scopes for that one application, without typing their password into it.
When an app sends you to "Log in with..." and you see "This app will receive: your public profile and email address", that list is the requested scope. The authorization server shows it, you approve or cancel, and the resulting access token is limited to those scopes. A token with scope profile email cannot be used to post messages, even though the same account can.
Why this matters:
- Least privilege: the app gets only what it needs. Many consent screens also let you edit or reduce the requested access.
- No credential sharing: the screen is served by the authorization server's domain, not by the app, so the app never sees your password.
- Informed decision: the screen names the app, so you know who you are delegating to.
Scopes are plain strings defined by each service; OAuth itself does not standardise their names. OpenID Connect does define some (openid, profile, email, address, phone).
Go deeper:
oauth.net: OAuth 2.0 Scopes — what scopes are for and how services design them.- RFC 6749, Section 3.3: Access Token Scope — the scope parameter's syntax and how the server may narrow it.