From All-or-Nothing to Task-Based OAuth Consent
Cloudflare, Thursday, August 20th, 2026
Cloudflare OAuth adds optional scopes so users grant only the access an app needs for the task at hand.
Cloudflare OAuth now supports optional scopes, giving users finer control over what an application can access and helping developers build consent flows scoped to the task at hand.
Since June, developers have created thousands of third-party OAuth apps on Cloudflare, with more than a million authorizations since. OAuth makes delegated access possible, letting applications act on a user's behalf without handling long-lived credentials or passwords.
That model works well when an application needs a stable, well-defined set of permissions, but breaks down when consent becomes an all-or-nothing grant. Optional scopes let the request match the specific action a user is taking.