Optional OAuth scopes shipped 20 August 2026: Cloudflare tokens can now come back narrower
On 20 August 2026 Cloudflare let users deselect optional scopes at consent. RFC 6749 has permitted narrower grants since 2012, and most OAuth clients still assume the full requested set was approved.
