2025-02-14 UTC
# 
aaronpk [snarfed]: i think the expectation is very dependent on the ecosystem. "traditional" oauth consumer services wouldn't have this problem because the client developers have to find the scopes from the docs anyway. would need to know more about the specific scopes and functionality of the client in order to know whether it would be better to error early or late