Build OAuth 2.0 scope strings for popular APIs (Google, GitHub, Microsoft, Slack) with permission descriptions.
OAuth Scope Builder turns selected permissions for Google, GitHub, Microsoft, or Slack into the scope string used in an OAuth 2.0 authorization request. It presents provider-specific scope tokens with descriptions, helping distinguish similarly named permissions before they are combined. The result is a request value, not proof of access. A common mistake is assuming that selecting a scope grants it automatically. The provider, application configuration, user consent, and any administrator policy still determine which permissions a token receives.
A concrete input and expected output from the current implementation.
Input
Provider: GitHub Selected permission: user:email
Expected output
user:email
With one GitHub scope selected, the output is that scope token unchanged. No comma, quotation marks, or additional separator is needed.
Choose one of the supported providers, then select permissions from that provider's scope list. Each displayed description explains the access represented by its adjacent token. Scope names are not translated between Google, GitHub, Microsoft, and Slack. Changing providers therefore changes the relevant permission vocabulary rather than merely changing a label on the same scope.
The selected tokens are combined into one OAuth scope value, separated by spaces when more than one scope is present. Token spelling and punctuation matter because OAuth scope strings are case-sensitive identifiers defined by the authorization server. Copy the result as the value of the request's scope parameter, allowing the code that constructs the URL to perform normal query encoding.
No. OAuth defines how the scope parameter is carried, but each authorization server defines its own scope tokens and meanings. A GitHub token such as user:email is not a portable equivalent of a Google, Microsoft, or Slack permission. Select the provider that matches the authorization endpoint and client registration used by the application.
No. The output records what the client requests. The authorization server can require consent, apply administrator policy, reject unsupported scopes, or return a narrower authorization. When the token response includes a scope value, compare it with the request instead of assuming the requested and granted permissions are identical.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Format, validate, and beautify JSON with syntax highlighting and error detection.
Encode text or files to Base64 and decode Base64 strings back to their original form.
Format and indent SQL queries for better readability across all major dialects.
Convert HTML markup into clean Markdown syntax with support for tables and lists.
Write Markdown and see the rendered HTML output in real time with live preview.
Visualize unified diffs and patch files with color-coded additions and deletions.