Which statement best describes scope in OAuth?

Which statement best describes scope in OAuth?

• A. Defines the granularity of access permissions granted to the client
• B. Defines the API rate limits
• C. Defines the UI styling
• D. Defines the handshake protocol

Answer: (A)

Scope controls the granularity of access permissions a client can be granted to a resource server. When a client requests authorization, it asks for specific scopes that describe what actions or data it needs. The authorization server issues a token containing the granted scopes, and the resource server enforces those scopes on every request, ensuring the client can only do what was approved. This is how OAuth implements least privilege, allowing you to grant minimal, specific access (for example, read-only access to a subset of data) rather than full control. It’s not about rate limits, UI styling, or the initial handshake; those aspects are governed by different parts of the system or protocol.

Scope controls the granularity of access permissions a client can be granted to a resource server. When a client requests authorization, it asks for specific scopes that describe what actions or data it needs. The authorization server issues a token containing the granted scopes, and the resource server enforces those scopes on every request, ensuring the client can only do what was approved. This is how OAuth implements least privilege, allowing you to grant minimal, specific access (for example, read-only access to a subset of data) rather than full control. It’s not about rate limits, UI styling, or the initial handshake; those aspects are governed by different parts of the system or protocol.