Cloudflare has added optional OAuth scopes, giving developers a way to mark permissions that users may decline on the consent screen instead of forcing an all-or-nothing decision. The change is aimed at agent and MCP server integrations, where applications often request broad access even when a user only wants to approve a smaller, safer subset.
Cloudflare brings partial consent to OAuth
With the new feature, Cloudflare OAuth clients can declare certain scopes as optional during configuration. Users can then deselect individual permissions before completing authorization, while required scopes remain mandatory. The company says this is meant to better match how agent-driven applications actually work in practice.
The core problem Cloudflare is addressing is that an agent may need many permissions in theory, but not all of them are appropriate in every real-world use case. For example, an inventory agent may need to read product data but not change prices, and a support workflow may need order status access without allowing refunds.
As Cloudflare described it, the current model often leaves developers with two poor choices: request only the minimum permissions and break more advanced flows, or request everything and risk users abandoning the consent process.
How optional scopes work
Under the new model, client owners can define an optional_scopes array alongside the normal scope list. In the example Cloudflare shared, the configured scopes include:
user-details.readworkers-scripts.writeworkers-kv-storage.writezone.read
Of those, workers-kv-storage.write and zone.read are marked optional. Cloudflare says required and optional scopes are evaluated against the scopes requested in a specific authorization flow, not against the full set configured for the client. That means if a client requests only two scopes, only those two are shown to the user.
Clients that do not opt in keep the existing behavior, in which the consent screen grants the full requested set by default. Cloudflare also notes that the feature does not change OAuth itself; RFC 6749 already allows authorization servers to issue tokens with a narrower scope than the application requested.
Why this matters for agents and MCP servers
Cloudflare explicitly names MCP servers as the motivating case. Agent integrations can be hard to judge on a consent screen because the agent may be capable of a wide range of actions, even if the current task only needs a subset of them. That creates a mismatch between what the application asks for and what the user is comfortable granting.
The company’s view is that optional scopes provide a more useful middle ground. Developers can require the permissions the app truly needs, while letting users decline access that is only relevant to certain features or future actions.
The runtime implication is important: if a user unchecks an optional scope, the resulting token includes only what was granted. Applications therefore need to inspect the returned scope information after exchanging the authorization code, rather than assuming a successful authorization means every requested permission was approved.
Developers will need to handle partial grants
Cloudflare says applications should degrade gracefully when scopes are missing. If a write permission is not granted, the feature depending on it should be disabled and explained to the user, rather than failing later with a confusing authorization error.
The change also makes developer assumptions less reliable. Code written for the old all-or-nothing flow may call APIs that no longer have the necessary permissions, leading to errors that were not previously possible when users always had to accept the full set.
That is especially relevant for agents, where a sensible pattern is to keep read access required, make write access optional when possible, and stop cleanly if the agent does not have authority to act. Cloudflare’s guidance suggests that this approach can lower risk without making integrations unusable.
Not the first platform to support narrower consent
Cloudflare is not introducing partial consent to the broader identity world, but it is adding a new level of control for developers. GitHub already allows users to edit scopes and grant less access than requested. Google presents granular checkboxes for non-sign-in scopes, and Microsoft Entra supports incremental consent, with granted scopes reflected in the token’s scp claim.
What is different here is the developer-side designation of which scopes may be dropped. That gives client owners more control over the authorization experience and helps them protect truly required permissions while leaving room for user choice on others.
A broader response to agent-era authorization
Cloudflare framed the release as part of a larger set of changes around agent authorization. The company said the new feature joins other efforts that address different pieces of the same problem, including the tightening of MCP client authorization in the 2026-07-28 specification and Microsoft’s hosted Azure DevOps MCP Server reaching general availability without support for Claude, ChatGPT, or Cursor because of Entra registration constraints.
Cloudflare also said it has seen more than a million authorizations across thousands of third-party OAuth apps created since June. The company plans to expand account- and zone-level roles over the coming weeks, including API token roles, account membership options, and OAuth scopes across nearly every product.
For developers building agentic workflows, the practical takeaway is straightforward: treat consent as something that can be partial, check the granted scopes at runtime, and design the app to cope when a user says no to the permissions that are not essential.
Source: Original report
Was this helpful?
Explore more: Software Development More Software Development Tech News
Last Modified: September 3, 2026 at 1:53 am
3 views
