The test failed. The API rejected the request because the Oauth scope was missing. You stare at the log. One line tells you everything: scope mismanagement breaks integration testing faster than any other configuration error.
Integration testing for Oauth scopes is straightforward in theory. In practice, it often turns into a maze. Scopes define exactly what a token can do. If they are wrong, your tests don’t cover reality. If they are too broad, your security is compromised. If they are too narrow, your features fail silently.
Start with scope definitions that match production. Do not use “*” or full-access scopes in tests unless the production system does the same. Map each API endpoint to the scope it requires. Document this in code. Tests should assert not only that requests succeed, but that they fail when scopes are missing or incorrect.
Automate token generation for each test case. Hardcoding tokens locks you into stale permissions. Instead, script the creation of test accounts with exact scopes. This lets the integration tests reveal permission drift immediately.