#oauth2

Designing OAuth2 scopes

Scopes are the access-control language of your API. Get them right and third-party integrations feel natural. Get them wrong and you're forever explaining to customers why the Slack bot can also delete their billing history. At minimum, split every resource into read: and write:. read:cases lets an integration list cases; write:cases lets it mutate them.…