2018-09-25 UTC
# 
Zegnat So a Micropub client will do the IndieAuth flow to gain a token to use. It then requests scopes it thinks it needs (create, update, delete). But your IndieAuth endpoint decides what tokens it will give. Maybe you do not give delete (because you are testing a client you have less trust in) or whatever. Or maybe you add an extra scope for a client you trust to also create newsletter emails (add a scope “email”).