From all-or-nothing to task-based OAuth consent

Cloudflare processed over one million OAuth authorizations under a strict binary limitation: users had to grant every requested permission or deny the application entirely. 👇

As Cloudflare added more granular permissions, this all-or-nothing approach broke down for tools like AI agents and MCP servers. These applications often request broad capabilities to handle arbitrary user tasks, but users rarely want an agent holding that much access. The only workaround was for app developers to build custom permission screens to filter scopes *before* sending the user to Cloudflare.

Cloudflare solved this by building scope customization directly into their OAuth authorization flow. Developers can now mark individual scopes as optional, letting users toggle off specific permissions right on the consent screen.

When a client initiates an authorization flow, Cloudflare evaluates required and optional scopes against only the scopes requested in that specific request, rather than every scope configured on the client.

If an application asks for four scopes and two are flagged as optional, Cloudflare displays all four, but allows the user to uncheck the optional ones. If that same app later initiates a flow requesting only two scopes, Cloudflare evaluates only those two for that session and ignores the unrequested ones entirely.

Once the user approves their chosen subset, Cloudflare generates an access token containing strictly the consented scopes. Developers exchange the authorization code and check the granted scope set in the response, allowing their application → agent to adjust its capabilities based on what access was actually granted.

Existing applications maintain their exact default behavior unless developers explicitly opt in. Apps can now request broad capabilities without scaring off security-conscious users, and developers no longer have to build custom UI pre-screens just to handle partial permissions.