{"version":"2.1.319","anchor":"oauth-token-refresh-no-longer-sends-scope","canonical_anchor":"oauth-token-refresh-no-longer-sends-scope","heading":"OAuth token refreshes no longer ask for a specific scope","tier":"notice","area":"MCP","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319\/e\/oauth-token-refresh-no-longer-sends-scope","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319","markdown":"### OAuth token refreshes no longer ask for a specific scope\n\nWhen Claude Code refreshes an OAuth sign-in token, it no longer sends a `scope` value, so the server grants its default access\n\n**What**\n\nOAuth is a standard way for one service to give another limited access without sharing a password. Some services, such as MCP servers, sign Claude Code in this way. MCP servers are outside tools that Claude Code can connect to. Claude Code renews the sign-in token from time to time. This renewal is called a refresh.\n\nA refresh request no longer includes the `scope` value, which lists the permissions being asked for. Before, Claude Code sent the stored scope whenever it had one. The server now decides which permissions the refreshed token gets, using its own default.\n\n**Why**\n\nA refreshed token may now carry different permissions than before. Servers that rejected a refresh because it included a scope may now accept it.\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: no"}