Cloudflare adds task-based OAuth consent with optional scopes, ending all-or-nothing grants for agents
Cloudflare Blog · rss · 2026-08-21
Cloudflare has introduced OAuth scope customization for third-party apps: developers can mark specific scopes on an OAuth client as required or optional, and users can deselect optional scopes at the consent screen—replacing the old all-or-nothing authorization experience.
Key mechanics
- Required/optional evaluation applies only to scopes actually requested in that authorization flow, not every configured scope; unrequested scopes are never shown or enforced
- When users narrow their grant, the issued access token contains only the consented scopes—developers must check the granted set after exchanging the code rather than assuming full approval
- Existing clients that don't opt in see no change in behavior
Agent/MCP relevance: MCP servers often request broad permissions, leaving users with approve-all-or-deny as the only choice. Agents that gracefully operate within narrower permission subsets earn user trust. Cloudflare will also expand account- and zone-level roles across nearly every product in the coming weeks.
More from coding & agent
- Decision models match LLMs on routing and safety — and are 7-8x faster — randal_olson · 2026-10-16
- Temporal Serverless Workers on Cloud Run: queue-driven autoscaling, scale to zero — rseroter · 2026-10-16
- Meta's Superintelligence Lab Runs 200+ Direct Reports—A Lesson for Flat Multi-Agent Systems — peterjliu · 2026-10-16
- LangChain CEO: the most interesting agent harness work lives at the harness-infra boundary — hwchase17 · 2026-10-16
- GitSwarm paper: agents share branchable Git memory, solving all 30 IMOProofBench problems in one run — anirudhg9119 · 2026-10-16
- Hands-on with Gemini 4 Argon: faster than Opus 5.5 but hallucinates more and costs more — prasenx · 2026-10-16