Summary
On August 20, 2026, Cloudflare let OAuth clients mark configured scopes as optional; on the consent screen users must grant required scopes but can decline optional ones.
What changed
Cloudflare OAuth clients can now mark scopes as optional, and users can decline optional scopes on the consent screen while required scopes remain mandatory.
Why it matters
Optional scopes let integrations follow least-privilege access, giving end users finer control over what an app can do and reducing over-broad OAuth grants.
Evidence excerpt
OAuth clients can now mark configured scopes as optional. On the consent screen, users must grant required scopes but can decline optional scopes.