2017-03-12 UTC
# 
sknebel another oauth2 question: an authorization endpoint is allowed to modify the scopes granted to an application, and the client should pass them through? E.g. if I want to tell my micropub endpoint that a client app only can create a specific post type, I could add a scope indicating that? Or should I encode it in the token itself?