A scope is an OAuth 2.0 mechanism that limits application access to a user account by bundling specific permissions that a client requests. OAuth does not define specific scope values because they depend heavily on the service's internal architecture and needs, requiring administrators to create custom scopes. Create a custom scope for a Custom Authorization Server in Okta by navigating to the Authorization Server settings and adding a new scope.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• API Access Management
• Custom Authorization Server

What are scopes, and how are they created for an Authorization Server?

Scopes are space-separated lists of identifiers that specify the access privileges an application requests. An application requests one or more scopes; the consent screen presents this information to the user, and the authorization server limits the issued access token to the granted scopes.

To create a scope for the Authorization Server in Okta, follow these steps or watch the video below:
 

1. Log in to the Okta Admin Console.
2. Go to Security > API > Authorization Servers.
3. Select the name of the Authorization Server and then click the pencil icon to edit it.

4. On the Authorization Server details page, click on the Scopes tab and then click the Add Scope button.

5. Enter a name and description for the new scope.
   • Optionally, select the Default scope checkbox to allow Okta to grant authorization requests to apps that do not specify scopes on an authorization request. If the scope parameter is not included in an authorization request, Okta will return all default scopes in the Access Token that are permitted by the access policy rule.
6. Select a User Consent option:
   • Implicit: The default setting. The user is not asked to grant the app access to the information. The user's consent is implied for this scope.
   • Optional: Users can skip accepting this scope when they see the consent screen on the Sign-In Widget.
   • Required: User consent is required for this scope, and users may not change their consent option. Click the Create button to create the new scope.

NOTE: If the selection is Optional or Required, clear the Block services from requesting this scope checkbox.

7. Click Create.

Related References

• Create Scopes | Create an authorization server | Okta Developer

• Create API access scopes | Okta Docs