How do I request a specific OAuth scope for the scanner's token?

Steps

1. Open the role in Authentication and make sure you ticked OAuth 2.0.
2. Find the Scope field. Its placeholder says optional.
3. Type the scope your provider expects. Check your provider's documentation or ask the person who manages the client for the exact text.
4. Press Complete authentication to see whether you get a token with that scope.
5. Press Save.

Good to know

• Leave Scope empty when your provider gives the client a default scope. It is optional.
• Ask for the smallest scope that lets the scanner reach the parts of the app you want covered. A wide scope gives the scanner more power than the job needs.
• The capture does not show how to write several scopes. Follow your provider's format and test it with the button.

A rejected scope normally shows up at the test step, which is a good reason to press the button before you save. If the exchange fails, go to why the OAuth check fails.

The scope you request only affects the token, so the rest of the role stays the same, and you can change it at any time by editing the profile. The other fields stay as they were: token URL, client ID, secret, header name and prefix. The full setup is in how to set up OAuth 2.0 client credentials.

Related questions

• How do I set up OAuth 2.0 client credentials for a role?
• How do I test the OAuth token exchange before running a scan?
• Complete authentication didn't return a token. What should I check?
• How do I change the header name or prefix the OAuth token is sent with?
• How does Cyberlop use OAuth 2.0 client credentials during a scan?

Full tutorial

OAuth client credentials in Cyberlop: scan APIs with a minted token

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre