Cloudflare kills all-or-nothing OAuth: users can now deselect optional scopes
Cloudflare is introducing task-based OAuth consent. Client owners can mark specific scopes as optional, so on the consent screen users can deselect the ones they're not comfortable granting instead of facing a binary approve-everything-or-deny choice. That's a real win for MCP servers and other agents that routinely request broad permissions users rarely need. Existing apps work unchanged; if no optional scopes are requested, the flow looks exactly as before.