This is a great point. I ranted about oauth2 relying parties in my other comment but oauth2 providers certainly don’t make it easy for people writing RPs to fi

This is a great point. I ranted about oauth2 relying parties in my other comment but oauth2 providers certainly don’t make it easy for people writing RPs to figure out what scopes are necessary. Even worse is that oauth2 doesn’t provide for any capability-based scope limitation, or token attenuation, or anything like that. If I want to be able to give write access to only a single google calendar instead of all of the calendars my account has write access to, the best thing I can do is give write access to a one-off Google account and then oauth2 to that account. There’s some XACML thing I’ve never heard of before today, no idea if anybody uses it in the wild.