Cloudflare Adds Optional OAuth Scopes, Letting Developers Mark What Users May Decline
Cloudflare's optional OAuth scopes solve a real agent problem: MCP servers request permission for everything they might do. Now developers can let users refuse some.
Why it matters
As agents become the default way to integrate with APIs, permission systems built for human users break down. Cloudflare is fixing a concrete friction point that will matter as agent deployments scale.
The key facts
10 to knowCloudflare added optional OAuth scopes feature
Developers can now mark which permissions users may deselect
MCP (Model Context Protocol) servers cited as primary motivating use case
Agents request union of all possible permissions they might need
Solves consent friction where agents need broad access but users want granular control
Developer control over optional scopes is novel (partial consent exists elsewhere)
Developers can now mark which permissions users may decline
Addresses agent pattern of requesting union of all possible actions
Developer control over droppable scopes is novel vs. existing partial-consent systems
Published September 2, 2026
Go to the source
InfoQ AI/MLinfoq.com
Publisher excerpt: Cloudflare has added optional OAuth scopes, letting client owners mark which permissions users may deselect at consent. The company names MCP servers as the motivating case, since agents request the union of everything they might do. Partial consent exists elsewhere, but developer control over…