OAuth Scope Cheatsheet — 60+ Scopes for Google, GitHub, Microsoft, Slack and More

Authenticate the user via OpenID Connect and receive an ID token with sub (user ID) and standard OIDC claims.

• Sign-in with Google — all you need for basic auth.
• Federated identity: use Google as your IdP without storing passwords.
• Single sign-on (SSO) to your own app.

Always request openid alongside profile or email; alone it only returns sub.

Read the user's basic profile: name, photo URL, locale, and Google account ID. Does NOT include the email address.

• Display user name and avatar after sign-in.
• Personalise the UI with the user's locale preference.
• Identify returning users by their Google account ID.

Read the user's Google account email address and whether it is verified.

• Use as a unique identifier for the user account in your database.
• Send transactional emails via your own SMTP (not on Google's behalf).
• Pre-fill email fields in sign-up flows.

Read all Gmail messages, threads, labels, and settings. Cannot send, modify, or delete anything.

• Email analytics: count replies, measure response time.
• Parse order confirmation emails to show a purchase history.
• Inbox zero tools that surface unread or starred messages.

Triggers Google restricted scope review. Publish a privacy policy and pass security assessment before going live.

Send email on behalf of the user. Cannot read, modify, or delete any messages.

• Send automated replies or acknowledgement emails from the user's address.
• Email-to-task tools that send a confirmation after creating a task.
• CRM sending follow-up emails through the user's own Gmail.

Triggers Google sensitive scope review. Prefer this over gmail when you only need to send.

Read, compose, send emails, and modify messages (apply labels, mark as read, archive, move to trash). Cannot permanently delete.

• Email workflow tools that triage inbox by labelling and archiving.
• Newsletter unsubscribe tools that move promo emails to a specific folder.

Restricted scope — requires Google security assessment and a thorough privacy policy.

Create, read, update, and delete Gmail labels. Does not read message content.

• Organiser apps that set up a folder structure on first run.
• Sync labels from your tool's own tagging system into Gmail.

View all Google Calendar event details, attendees, and free/busy information.

• Scheduling assistants that show existing events when suggesting a meeting time.
• Time tracking apps that pull in calendar events as logged work sessions.
• Dashboard widgets displaying today's schedule.

Sensitive scope — triggers review. Use the free/busy API with calendar.freebusy if you only need availability.

Full access to Google Calendar: create, read, update, and delete all events and calendars.

• Two-way sync between your app's task list and Google Calendar.
• Meeting scheduling tools that create calendar blocks.

Restricted scope. Use calendar.events if you only manage events (not calendar metadata).

Access only files created by your app or files the user explicitly opens with your app via the Drive file picker. Cannot browse all Drive files.

• Document editors that save and open their own files in Drive.
• Backup apps that create a folder and upload files into it.
• Apps that let users pick an existing file with the Drive file picker.

Prefer this over drive or drive.readonly for most apps — it requires no special review and limits blast radius.

View and download all files in the user's Google Drive. Cannot create, modify, or delete.

• AI assistants that read the user's documents for context.
• File migration tools that enumerate and download Drive content.

Sensitive scope — triggers review. Use drive.file if you only need files your app created.

Full access to all files in Google Drive including create, modify, delete, and manage permissions.

• Full Drive management dashboards that can organise, rename, move, and delete.
• Team tools that share and restructure entire Drive hierarchies.

Restricted scope requiring Google security assessment and sometimes a third-party audit. Justify why drive.file or drive.readonly cannot meet your needs.

Read all spreadsheet data, formulas, formatting, and named ranges.

• BI tools that pull data from Google Sheets as a data source.
• No-code app builders that use Sheets as a backend database.

Sensitive scope. The Sheets API also has per-spreadsheet access via the Drive file picker if full read access is too broad.

Full access to all spreadsheets: read, write, create, and delete.

• Reporting tools that write results back into a tracking spreadsheet.
• CRMs that sync contact data bidirectionally with a Sheets database.

Sensitive scope triggering review. Prefer spreadsheets.readonly if you only read data.

Read the authenticated user's profile data: name, bio, avatar, location, company, follower count.

• Show user avatar and name after GitHub sign-in.
• Pre-fill profile fields in your app from their GitHub profile.

Read the user's email addresses (including private ones) and which is the primary.

• Use a verified GitHub email as the account identifier in your database.
• Link a GitHub account to an existing account by email match.

Users can hide their email on GitHub but it is still returned here. Treat it as PII.

Full read/write access to profile data including email, followers, following, and starred repos.

• Apps that update the GitHub profile bio or avatar on the user's behalf.

Usually read:user + user:email covers what you need without write access.

Read and write access to public repositories only. Includes code, issues, pull requests, and commit statuses.

• Open-source tools that comment on public issues or PRs.
• Portfolio apps that list and display public repositories.
• CI integrations setting commit statuses on public repos.

Full read/write access to all repositories including private ones: code, issues, PRs, wikis, deployments, and settings.

• Development tools like IDEs and code review apps that need private repo access.
• Deployment pipelines that push code and update deployment statuses.
• Full-featured GitHub clients or mirrors.

This is the broadest GitHub scope. Users sometimes see it as a red flag. Use repo:status or public_repo if you can. For GitHub Apps, use fine-grained permissions instead.

Read and write commit status for public and private repositories. The minimum needed for CI/CD systems.

• CI/CD pipelines updating ✅/❌ commit status after a build.
• Code quality bots marking commits as passing or failing.

Add and update GitHub Actions workflow files (.github/workflows/*.yml).

• Tools that scaffold CI pipelines for new projects.
• Automation platforms that modify workflow configuration.

Allows code execution on GitHub infrastructure. Requires careful review — only grant to apps you fully trust.

Read and mark notifications; mark threads as read or unsubscribe.

• GitHub notification dashboards and triage tools.
• Mobile apps surfacing unread review requests.

Create and edit gists on behalf of the user.

• Code snippet sharing tools that save directly to GitHub Gist.
• Pastebin-alternative apps backed by Gist.

Delete repositories the user has admin access to.

• Cleanup scripts that archive and delete deprecated repos.

Irreversible. Request only if your core feature genuinely requires deletion. Never include this as a default scope.

Read org and team membership, and organisation project board info.

• Tools that check if a user belongs to a GitHub organisation for access control.
• Team dashboards showing org membership.

Full control of organisations and teams: create, update, delete members and teams, and manage org settings.

• HR tools that sync employee directory to GitHub org membership.
• Onboarding automation that adds new hires to the right teams.

Only available to org owners. Grants the ability to add/remove all members.

Download packages from GitHub Package Registry.

• CI pipelines installing private npm or Docker packages from GPR.

Upload packages to GitHub Package Registry.

• CI pipelines publishing npm, Docker, or Maven packages to GPR on release.

Issue an ID token for OpenID Connect sign-in. Returns oid (user object ID) and other OIDC claims.

• Microsoft/Azure AD sign-in for web or mobile apps.
• SSO using Azure AD as the identity provider.

Sign in and read the logged-in user's profile: display name, job title, email, photo.

• Show user name and avatar post sign-in.
• Populate employee directory entries with Graph data.

Receive a refresh token so the app can maintain access when the user is not present.

• Background sync that runs overnight without user interaction.
• Any app needing long-lived access beyond the 1-hour access token lifetime.

Required whenever you need a refresh token. Pair with your other scopes.

Read all mail in the user's mailbox, including attachments and metadata.

• Email analytics and reporting dashboards.
• Document management tools that index email attachments.

Delegated: acts on behalf of the signed-in user. Application permission variant (Mail.Read without user) requires admin consent.

Send mail as or on behalf of the signed-in user.

• Apps that send automated follow-ups from the user's Outlook address.
• CRMs sending sales emails through the rep's own mailbox.

Read the user's calendar events and meeting details.

• Scheduling tools that avoid double-booking by reading existing events.
• Time-tracking tools that log meeting time automatically.

Create, read, update, and delete calendar events.

• Meeting scheduling apps that write calendar blocks.
• Two-way sync between your app and Outlook calendar.

Read all files the signed-in user can access in OneDrive and SharePoint.

• Search and discovery tools indexing OneDrive content.
• Document AI tools reading all files for analysis.

Full access to all files the user can access: read, write, create, delete.

• File management dashboards managing OneDrive/SharePoint content.

Prefer Files.ReadWrite for app-managed files only, or use the Files.ReadWrite.AppFolder scope for a sandboxed app folder.

Read all directory data in the Azure AD tenant: users, groups, devices, applications.

• IT admin tools listing all users and group memberships.
• Security tools auditing AAD configuration.

Requires admin consent for the tenant — individual users cannot grant this. Not suitable for consumer apps.

View basic information about public channels in the workspace.

• Bots listing available channels to let users choose where to post.
• Dashboards displaying workspace channel structure.

Send messages as the app (not as a user). The standard scope for posting bot messages.

• Notification bots that alert a channel on deploy, alert, or event.
• Standup bots asking daily questions in a channel.
• Integrations posting summaries or reports into Slack.

Create, archive, and rename public channels, and manage channel memberships.

• Project management tools that create a Slack channel per project.

View files shared in channels and conversations the app has access to.

• Document search tools indexing files shared in Slack.

View basic information about workspace members: display name, timezone, status. No email.

• Apps that tag or mention workspace members by name.
• Scheduling tools that check member timezones.

View email addresses for workspace members. Requires users:read as a prerequisite.

• CRMs matching Slack users to contact records by email.
• SSO tools linking Slack accounts to your internal directory.

User email addresses are PII. Slack workspace admins may restrict this scope.

View the workspace name, icon, domain, and email domain.

• Multi-workspace apps that show the workspace branding in the UI.

Read the user's email address registered on their Spotify account.

• Use as account identifier or for sending transactional emails.

Read the user's subscription level (Free, Premium), country, and product type.

• Feature gates that unlock premium content only for Spotify Premium users.

Read private and collaborative playlists the user has created or subscribed to.

• Music apps displaying all user playlists including private ones.

Create and edit public playlists on behalf of the user.

• Collaborative playlist tools that add tracks based on recommendations.
• Concert setlist apps that create a playlist from the show.

Create and edit private playlists.

• Mood or activity playlist generators saved privately.

Read the user's saved songs and albums (Your Library).

• Music stats apps showing the user's listening library.

Read the user's top artists and tracks over different time ranges.

• Music personality and taste analysis apps.
• Year-in-review tools (your own Spotify Wrapped).

Read tweets, timelines, and public conversation data for the authenticated user and other users.

• Social media dashboards pulling in mentions and replies.
• Sentiment analysis tools consuming public tweet streams.

Create, delete, and hide tweets and replies on behalf of the user.

• Social media scheduling tools posting tweets on a schedule.
• Thread management tools that delete and re-post cleaned-up threads.

Read public user profile information: name, bio, follower/following counts.

• Profile enrichment — pulling social context into a CRM.

Read the user's follower and following lists.

• Audience analysis showing who follows you and who you follow.

Get a refresh token to maintain access without requiring the user to re-authorize.

• Scheduled posting tools that need to act while the user is offline.

Read the tweets the user has liked.

• Read-it-later tools that bookmark liked tweets.

Like and unlike tweets on behalf of the user.

• Engagement automation tools (use ethically and within Twitter API rules).

Read the user's Discord username, discriminator, avatar, and user ID. Does NOT include email.

• Discord sign-in — show username and avatar after auth.
• Link a Discord account to your platform without storing passwords.

Read the email address associated with the user's Discord account.

• Use as account identifier or to match with an existing account in your database.

List the guilds (servers) the user is a member of, along with their roles.

• Gating features by server membership — "must be in XYZ server to access".
• Dashboard showing which communities the user belongs to.

Add the user to a guild (server) without requiring them to click an invite link.

• Onboarding flows that automatically add new customers to a support server.

Requires a bot token in the same request. User is added silently — use with a clear UI disclosure.

Add a bot to a guild with the permissions specified in the OAuth URL.

• Slash command bots that users install directly into their servers.
• Moderation bots authorized via OAuth guild install.

Permissions for the bot are separate from this scope — specify them with the permissions bitmask in the OAuth URL.

Read the member's name, headline, profile photo, and vanity URL.

• LinkedIn sign-in — populate user name and avatar.
• Import profile data to create an account without a registration form.

Read the member's primary email address registered on LinkedIn.

• Use email as unique identifier for account linking.

Create, edit, and delete posts, comments, and likes on LinkedIn on behalf of the member.

• Social media schedulers that post content to LinkedIn on a schedule.
• Content amplification tools that auto-comment on company posts.

Read-only access to the connected Stripe account: view charges, customers, products, and payouts.

• Financial dashboards that display revenue and payout data.
• Analytics tools auditing subscription metrics across connected accounts.

Stripe Connect: the user connects their own Stripe account, not yours. Use read_only unless your feature actively needs to create or modify data.

Full read and write access to the connected Stripe account: create charges, issue refunds, manage subscriptions.

• Payment platforms that create charges on behalf of connected merchants.
• Billing tools that manage subscriptions and issue refunds.

Grants full control over the user's Stripe account including issuing refunds and modifying payout settings. Justify in your Stripe app review.