Cloudflare adds task-based OAuth consent with optional scopes, ending all-or-nothing grants for agents
Cloudflare Blog · rss · 2026-08-21
Cloudflare has introduced OAuth scope customization for third-party apps: developers can mark specific scopes on an OAuth client as required or optional, and users can deselect optional scopes at the consent screen—replacing the old all-or-nothing authorization experience.
Key mechanics
- Required/optional evaluation applies only to scopes actually requested in that authorization flow, not every configured scope; unrequested scopes are never shown or enforced
- When users narrow their grant, the issued access token contains only the consented scopes—developers must check the granted set after exchanging the code rather than assuming full approval
- Existing clients that don't opt in see no change in behavior
Agent/MCP relevance: MCP servers often request broad permissions, leaving users with approve-all-or-deny as the only choice. Agents that gracefully operate within narrower permission subsets earn user trust. Cloudflare will also expand account- and zone-level roles across nearly every product in the coming weeks.
More from coding & agent
- Agentic coding accessibility will reshape understanding of software complexity — pixlpa · 2026-08-24
- Devin Agent bypasses Slack block by finding emails in git logs — sandylikesfrogs · 2026-08-24
- Developer habits shift: Agents become collaborators from simple tools — latticecut · 2026-08-24
- Dev bottleneck shifts from writing to reading code: exe.dev co-founder — thursdai_pod · 2026-08-24
- The biggest AI mistake: trying to reinvent the wheel instead of using tools — Tired40s · 2026-08-24
- DeepPaperNote turns research papers into Obsidian notes — tom_doerr · 2026-08-24