A scope is a named bundle of claims. When a client requests a scope and the user consents, the claims that scope carries can be released to that client. For the conceptual picture, see Entities.
- Scope ID — lowercase letters, digits and underscores, starting with a letter (e.g.
openid,profile,orders_read). - Description — a label shown to users during consent and to admins in the console.
- Claims — the set of claim names this scope releases. Each claim also carries its own description.
A client can only request scopes it has been explicitly granted; the
scopes actually requested and consented to at login determine which claims end up in the ID
token and at the userinfo endpoint.