Cloudflare adds task-based OAuth consent controls

Cloudflare has introduced a granular consent model for its OAuth authorization flows, giving users the ability to selectively approve or deny individual permissions when connecting third-party applications. The update addresses a long-standing limitation in delegated access systems where users faced an all-or-nothing choice when granting permissions to apps acting on their behalf. Previously, if an application requested multiple scopes, users could either accept the full set or reject the entire request—no middle ground existed for narrowing access to only what was necessary for a specific task. This often led to overprivileged integrations, particularly for tools like multi-cloud provisioning (MCP) servers that might request broad permissions but only use a subset for routine operations.

How the new system works

The optional scopes feature allows developers to designate certain permissions as non-essential when configuring an OAuth client. During the authorization flow, users see a consent screen that clearly separates required scopes from optional ones, with the ability to deselect any optional permissions before approving the request. The system evaluates only the scopes requested in that specific authorization flow, not the full set configured for the client. For example, if an app is configured with four scopes but only requests two during a particular flow, the consent screen will only display those two—even if one of the unrequested scopes was marked as optional in the client configuration. This keeps the interface focused on the immediate task and prevents users from being overwhelmed by permissions not relevant to the current operation.

The change is backward-compatible: existing OAuth clients retain their current behavior unless developers explicitly opt into optional scopes. When a user deselects optional permissions, the resulting access token contains only the approved scopes, requiring developers to check the granted scope set after exchanging the authorization code rather than assuming the full requested set was approved. Cloudflare has also updated its API to allow developers to mark scopes as optional during client configuration, using a new optional_scopes parameter in the OAuth client creation or update requests.

Impact on developers and users

For developers, the update reduces the need to build custom pre-authorization screens to narrow scope requests. Instead, they can rely on Cloudflare’s consent flow to handle granular permission selection, simplifying the integration process for tools that require flexible access levels. The change also encourages better security practices by allowing apps to request only the minimum permissions needed for a task while marking the rest as optional—a signal to users that the app respects their access decisions. Users, particularly security-conscious ones, gain more control over what they approve without being forced into an all-or-nothing choice.

Cloudflare plans to expand its role-based access controls over the coming weeks, extending granular permissions to nearly all of its products. This will include additional API token roles, account membership options, and OAuth scopes, providing customers with more tools to secure workloads with precise access levels. The optional scopes feature is available now for all third-party OAuth apps, with no changes required for existing integrations unless developers choose to adopt the new model.

Sources

From all-or-nothing to task-based OAuth consent – Cloudflare Blog