OAuth Scope Checker
Check whether a requested scope is present in the space separated list a token came back with, matched literally as OAuth 2.0 requires.
Resultado
—
Why a nearly matching scope still fails
The endpoint returns 403 with insufficient_scope and you end up eyeballing two lists of strings: the one that came back in the token and the one the docs demand. It is easy to read read:users and read:user as the same thing, or to assume profile already covers email. With seven or eight granted scopes on a single line, comparing them by sight is asking for trouble.
The rule OAuth 2.0 uses is blunt: scope is a space separated list and each entry is matched literally. There is no built in hierarchy, no wildcard, no inheritance. read:users does not grant read:users:email, and admin opens nothing on its own. If your authorization server treats one scope as covering another, that is its own convention rather than part of the spec. Case matters too.
In practice, use the exact list from the scope field of the token response, not the one you asked for at authorization time, since a user can decline part of the consent and the two then differ. Anything missing needs a fresh consent round. If the scopes line up and the API still says no, check audience, tenant and expiry before touching scopes again. The comparison happens in the browser, with nothing sent out.
Frequently asked questions
Are OAuth scopes case sensitive?
Why did the token come back with fewer scopes than I requested?
Is there a wildcard like read:* in OAuth?
Related Tools
LGPD Privacy Policy Section Checker
Paste a policy written in Portuguese and see which of 10 sections the LGPD expects are covered: collection, purpose, sharing, rights, cookies, DPO, retention.
JWT alg Allowlist Policy Checker
Decodes the JWT header, reads its alg field and flags the token when the value is none or absent from the comma-separated list of algorithms you allow.
client_id / client_secret Validator
Validate the format of an OAuth client_id and client_secret, checking valid characters and minimum length. Useful for debugging auth integrations and APIs.
YAML Anchor Circular Reference Validator
Detect anchors with circular references (loops) in YAML documents, common in complex Helm/Kubernetes configurations.
hreflang vs lang Consistency Checker
Compares the html lang attribute with the main link hreflang value and flags an exact match, the same base language with a different region, or a mismatch.
Twitter/X @handle Validator
Validate Twitter/X handle format: 1-15 chars, letters, digits and _. Does not check availability.