Understanding OAuth2 Scopes vs Roles: When to Use Scope and Role in Access Control

After adopting the OAuth2.0 authorization protocol, API access control introduces the concept of scope, which can be confusingly similar to role‑based access control. This article clarifies both concepts.

Scope

scope

is a mechanism in OAuth 2.0 used to limit a client application's access to a user's account. A client can request one or more scopes, and the resource owner (the end user) can deny, partially accept, or usually fully accept the requested scopes. The resulting access token access_token contains the user‑approved scopes, and the token can only access resources limited to those scopes.

httpSecurity.mvcMatcher("/message/**")
                .authorizeRequests(requests ->
                requests.mvcMatchers(HttpMethod.GET, "/message/read")
                        .access("hasAuthority('SCOPE_openid')"))

In short, scope defines the range of resources a client may access.

Role

role

is a core concept of RBAC (role‑based access control). It restricts which resources can be accessed and determines what role a user assumes within the application, decoupling resources from users and simplifying permission management. From the user's perspective, role is a way to control access.

httpSecurity.mvcMatcher("/message/**")
                .authorizeRequests(requests ->
                requests.mvcMatchers(HttpMethod.GET, "/message/read")
                        .access("hasAuthority('ROLE_USER')"))

Relationship Between Scope and Role

Logically, a user simply authorizes a client application to access APIs that the user itself is permitted to use.

httpSecurity.mvcMatcher("/message/**")
                .authorizeRequests(requests ->
                requests.mvcMatchers(HttpMethod.GET, "/message/read")
                        .access("hasAnyAuthority('SCOPE_openid','ROLE_USER')"))

Scope is based on the client application, role is based on the user; both serve access control. APIs authorized to a third‑party must be accessible by that user, but not every API a user can access can be authorized to a third‑party.