Optional OAuth scopes now GA
Cloudflare now allows OAuth client developers to mark configured scopes as required or optional, enabling users to selectively grant permissions and apply least-privilege access controls. The consent screen includes new templates and search functionality to make scope selection easier.
We're announcing the GA of Optional OAuth Scopes.
OAuth client developers can now classify configured scopes as required or optional in the Cloudflare dashboard. By default, all configured scopes remain required .
What's New
Optional Scopes: OAuth clients can now mark configured scopes as optional, allowing applications to request them without requiring users to approve them.
Scope Selection: On the consent screen, users must grant required scopes but can decline optional scopes. This helps customers apply least-privilege access to applications, CLIs, and workloads. Optional scopes are selected by default.
Templates: The consent screen now includes Read Only and Full Access templates to make scope selection faster and easier.
Search: Users can now search scopes in the consent screen.
Learn how to select client scopes and edit optional permissions.
Source: original entry ↗
More from Cloudflare
Follow Cloudflare to get its new changes in your feed and email digest.
Improved HTTP/3 client cancellation reporting
Cloudflare now properly stops HTTP/3 requests when clients cancel them and reports these consistently as 499 status codes. This reduces unnecessary origin work and provides clearer visibility into client behavior across all plan types.
WAF failed detections field now available in Rules
A new cf.appsec.request.failed_detections field lets you control how rules handle requests when security detections fail. This array of detection IDs covers content scanning, WAF attack scoring, attack signatures, leaked credentials, and AI-based PII/prompt injection/custom topic detection failures, and works across custom rules, rate limiting rules, and request header transform rules.
Markdown for Agents: More efficient in-process streaming conversion
Markdown for Agents now uses an in-process streaming engine at the edge to convert HTML, reducing overhead and memory use. The conversion limit increased from 2 MiB to 6 MiB, and token count headers are no longer generated.