invalid_scope Authentication Origin: Application & API Last updated 13 Oct 2026

OAuth 2.0 Error: invalid_scope / insufficient_scope

The requested scope is unknown or not allowed for this client — or the token lacks the scope the API endpoint requires.

Exact message you may see The provided value for the input parameter scope is not valid
Explore the map of this error Full error map →
Seen on: Microsoft Google REST API

Meaning

invalid_scope comes from the authorization/token endpoint when you ask for scopes that don’t exist or aren’t granted to the app. insufficient_scope (often with 403) comes from a resource API when the token is valid but doesn’t carry the needed permission.

Common causes

  • Typo or wrong format (space-separated in OAuth; some providers use full URIs like https://graph.microsoft.com/.default)
  • Scope not enabled/added for the app in the provider console
  • Admin consent required but not granted (Microsoft, Google Workspace)
  • Mixing scopes for different resources in one request
  • Token issued before new scopes were added — user must re-consent

⚡ Quick fix

  1. Copy scope names exactly from the provider docs
  2. Add/enable the scope (API permissions) for the app and grant admin consent if needed
  3. Request a new token after changing scopes (and re-prompt consent)
  4. Decode the access token and check the scope/scp claim

Detailed fix by platform

Microsoft

  1. App registration → API permissions → add the permission → “Grant admin consent”. Client-credential flows must request <resource>/.default.

Google

  1. Enable the API in the Cloud project and add the scope on the OAuth consent screen; sensitive scopes may need verification.

How to diagnose

  1. Where — Token endpoint (invalid_scope) or resource API (insufficient_scope)?
  2. Requested — Exact scope string sent
  3. Granted — scope/scp claim in the token
  4. Consent — Has the user/admin consented to the new scopes?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

403 — HTTP 403 Forbidden (HTTP)403AADSTS500113 — AADSTS500113: No reply address is registered for the application (Azure)AADSTS500113AADSTS65001 — AADSTS65001: The user or administrator has not consented to use the application (Azure)AADSTS65001Access to the path is denied — System.UnauthorizedAccessException: Access to the path 'x' is denied (.NET)Access to the path is…access_denied — OAuth 2.0 Error: access_denied (The user or authorization server denied the request) (Authentication)access_deniedAccessControlListNotSupported — AccessControlListNotSupported: The bucket does not allow ACLs (AWS)AccessControlListNotS…AccessDeniedException — java.nio.file.AccessDeniedException: /path (Java)AccessDeniedExceptionauth/popup-closed-by-user — Firebase Auth: auth/popup-closed-by-user / auth/popup-blocked / auth/cancelled-popup-request (Authentication)auth/popup-closed-by-…invalid_s…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.