Episode notes
Jordan and Riley unpack Cloudflare's shift from all-or-nothing OAuth consent to optional scopes — letting developers mark each scope as required or optional so users can deselect what a given task doesn't need, with the resulting access token carrying only what was actually granted. They cover the key mechanism (required-vs-optional is evaluated only against the scopes requested in that specific flow, keeping the consent screen focused on the immediate task), why it matters in the MCP and agent era, and the engineering catch — apps now have to handle partial grants gracefully instead of assuming full approval. This is original commentary, not a reproduction of the original post.
Source: "From all-or-nothing to task-based OAuth consent" by Miller Vargas and José Enrique Rodríguez, The Cloudflare Blog, Aug 20 2026 — https://blog.cloudflare.com/task-based-oauth-consent/