OAuth Scopes Reference

Use the search bar on this page to search across all providers by capability. For example, search for "email" to find all scopes related to reading or sending emails across Google, Microsoft, GitHub, and others. You can also browse each provider's scopes by category. Each scope includes a plain-English description of what it grants access to, helping you find the exact scope string you need.

A sensitive scope is one that accesses personal data, performs destructive operations, grants administrative privileges, or accesses financial information. These scopes are marked with a warning badge in the reference. Many providers require additional app review or verification before allowing applications to use sensitive scopes. You should always question whether a sensitive scope is truly necessary for your application and prefer less-privileged alternatives when possible.

The principle of least privilege means an application should only request the scopes it actually needs to function, and no more. For example, if your app only needs to read public repositories, request "public_repo" instead of "repo". If it only needs to send emails but not read them, request "gmail.send" instead of "gmail.readonly" or "gmail.modify". Following least privilege reduces security risk and builds user trust.

The OAuth2 specification does not define standard scope strings - each provider creates their own. Google uses full HTTPS URLs as scope identifiers (e.g., https://www.googleapis.com/auth/drive), while GitHub uses short colon-separated strings (repo, user:email). Microsoft uses PascalCase with dots (User.Read, Mail.Send), and Twitter/X uses lowercase with dots (tweet.read, dm.write). This variety is why having a unified reference is valuable for developers working with multiple providers.

Scopes are included as the "scope" query parameter in the OAuth2 authorization request URL. Multiple scopes are separated by spaces (or URL-encoded as %20). For example: https://github.com/login/oauth/authorize?scope=repo%20user%3Aemail&client_id=... The exact format depends on the provider, so always check the provider's OAuth2 documentation. Some providers also allow requesting additional scopes during token refresh.

Yes, most OAuth2 providers allow users to view and revoke individual scopes from their account security settings. On Google, users can manage third-party app access from their Google Account. On GitHub, users can review authorized applications in Settings > Applications. Your application should handle the case where some scopes are revoked while others remain - always check which scopes were actually granted and degrade functionality gracefully.

Yes! The OAuth Scopes Reference is 100% free with no signup, no API key, and no usage limits. Browse as many scopes as you need, across all 7 providers. All scope data is embedded directly in the page - no network requests are needed. We do not store, log, or process any search queries or browsing activity on our servers.