Cloudflare OAuth now supports optional scopes, letting apps request granular permissions instead of the old all-or-nothing model.
Previously, Cloudflare OAuth consent was binary — approve everything the app asked for, or reject it entirely. That changed yesterday. Apps can now mark specific scopes as optional, and users can grant or deny them individually during the consent flow.
From the developer side, you add optional: true to your scope declarations. The API surfaces which scopes were granted and which were skipped, so your app can adapt its behavior — degrade features gracefully instead of crashing on a missing permission. On the user side, the consent screen shows a per-scope toggle, with a clear visual distinction between required and optional permissions.
This matters for two reasons. First, it reduces friction — users are far more likely to approve an app that only asks for what it needs right now, with the option to expand later. Second, it shrinks the blast radius: a compromised token scoped to one task can't pivot to others.
It's a small change in API semantics that makes Cloudflare OAuth behave more like modern OAuth 2.0 implementations (GitHub's token scopes, Google's granular consent). For anyone building on Cloudflare's API — Workers, Pages, D1, R2 — this is a meaningful improvement in developer experience and security posture.