OAuth scopes are named permissions that define what an app is allowed to access or do in your account after you approve an OAuth sign-in, such as reading email, creating calendar events, or viewing files. The app requests specific scopes, you see them on the consent screen, and the access token it receives works only within those scopes.
How OAuth scopes work
OAuth 2.0 (RFC 6749) lets an app ask for access to your account without ever seeing your password. The app sends you to the provider, such as Google or Microsoft, with a list of scopes. You approve or cancel. If you approve, the provider gives the app an access token limited to those scopes. Each scope is a string defined by the provider, like Google's gmail.readonly. A scope-by-scope walkthrough for Google is in Gmail OAuth scopes explained.
Why the scope names matter
Scopes are the most honest description of an app's access. Marketing copy might say "reads your email to help you," but the scope tells you whether the app can only read, or can also send, modify, or delete. Narrower is better: an app that only needs your calendar availability shouldn't request full Drive access.
Google groups scopes by risk. Restricted scopes, which include Gmail's read and modify scopes, require verification before an app can request them. Apps that can access that data from or through their own servers also need a security assessment by a Google-empanelled assessor at least every 12 months.
OAuth scopes vs. account passwords
Giving an app your password hands over everything. OAuth scopes hand over only what's listed, and you can revoke the grant without changing your password, in Google's case at myaccount.google.com/permissions.
Synced lists every Google scope it requests, and what each is used for, in its privacy policy.
- RFC 6749: The OAuth 2.0 Authorization Framework, section 3.3 (checked 2026-09-13)
- Google: Restricted scope verification (checked 2026-09-13)