invalid_
Registry Context
OAuth error code indicating that a requested scope is invalid, unknown, malformed, or, for token requests, exceeds the scope granted by the resource owner. It can also indicate that no default scope applies when an authorization request omits `scope`.
Technical Summary
RFC 6749 defines `invalid_scope` for token endpoint error responses and for authorization error responses in the authorization code and implicit grants. Its precise meaning differs slightly: token errors also include requests exceeding the scope granted by the resource owner.
When Used
Use for an invalid, unknown, or malformed requested scope; at the token endpoint, also for a request exceeding the granted scope. It may also indicate that an authorization request omitted `scope` and no predefined default was applied.
Normative Requirements
Authorization servers
RFC 6749 - Section 4.1.2.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter value..
Condition: when serializing an authorization code grant error response
"Values for the \"error\" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E."
RFC 6749 - Section 4.2.2.1
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter value..
Condition: when serializing an implicit grant error response
"Values for the \"error\" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E."
RFC 6749 - Section 5.2
include characters outside `%x20-21 / %x23-5B / %x5D-7E` in the `error` parameter value..
Condition: when serializing a token error response
"Values for the \"error\" parameter MUST NOT include characters outside the set %x20-21 / %x23-5B / %x5D-7E."
RFC 6749 - Section 3.3
either process the request using a predefined default value or fail the request indicating an invalid scope..
Condition: when the client omits `scope` while requesting authorization
"the authorization server MUST either process the request using a pre-defined default value or fail the request indicating an invalid scope."
RFC 6749 - Section 4.1.2.1
include the `error` parameter as a single ASCII error code; `invalid_scope` is the defined value when the requested scope is invalid, unknown, or malformed..
Condition: when returning an authorization code grant error response for the described scope failure
"error REQUIRED. A single ASCII [USASCII] error code"; `invalid_scope` means the requested scope is invalid, unknown, or malformed.
RFC 6749 - Section 4.2.2.1
include the `error` parameter as a single ASCII error code; `invalid_scope` is the defined value when the requested scope is invalid, unknown, or malformed..
Condition: when returning an implicit grant error response for the described scope failure
"error REQUIRED. A single ASCII [USASCII] error code"; `invalid_scope` means the requested scope is invalid, unknown, or malformed.
RFC 6749 - Section 5.2
include the `error` parameter as a single ASCII error code; `invalid_scope` is the defined value for an invalid, unknown, or malformed requested scope, or one exceeding the scope granted by the resource owner..
Condition: when returning a token error response for the described scope failure
"error REQUIRED. A single ASCII [USASCII] error code"; `invalid_scope` includes scope exceeding that granted by the resource owner.
RFC 6749 - Section 3.3
document its scope requirements and its default scope value, if one is defined..
"The authorization server SHOULD document its scope requirements and default value (if defined)."
Validation Guidance
Use `invalid_scope` for invalid, unknown, or malformed requested scopes; for token errors, also permit it when the request exceeds the scope granted by the resource owner.
When an authorization request omits `scope`, verify that the server either applies a predefined default or fails the request indicating an invalid scope.
Ensure an `error` value containing `invalid_scope` uses only the character set permitted for the applicable error response.
Verify that the authorization server documents its scope requirements and any defined default scope.
Security Notes
RFC 9700 - Section 2.1.2
RFC 9700 advises clients not to use the implicit grant or other response types that issue access tokens in the authorization response unless token injection and leakage risks are mitigated; clients should instead use an authorization-code-based response type.
Reference
Details
- Entry Id
invalid_scope - Name
invalid_scope - Usage Location
authorization endpoint, token endpoint- Protocol Extension
OAuth 2.0 Authorization Framework- Change Controller
IETF- Reference
RFC6749