The request hit the server. The token was valid. But the data flowing through it was more than the user should ever see.
OAuth scopes define the boundaries of access. They decide which actions an application can perform and which data it can touch. Poor scope management means an access token can silently overreach, pulling sensitive fields the user never asked for. Misconfiguration here is one of the fastest ways to leak data without breaking a single authentication rule.
Scopes must be granular. Read-only for certain resources, write privileges for others, and exclusion for anything outside the intended workflow. Large, blanket scopes give away too much. When defining or reviewing them, start from zero and add only what the app truly needs. OAuth providers make it easy to set broad permissions — the hard work is resisting that convenience.
Data masking is the second half of control. Even within allowed scopes, not all data should be shown in raw form. Masking replaces sensitive values with obfuscated or tokenized versions, letting systems operate without revealing full details. This protects account numbers, personal info, and any field at high risk. Masking should be applied consistently across APIs, responses, logs, and analytics pipelines.