Authorization · Access control
Scopes, roles and audience: three separate boundaries
A token for the correct API still needs permission for the operation.
Understand the concept
Audience identifies the intended target, scope expresses an access boundary from an authorisation flow, and roles categorise a user or application. Claim names and formats vary by provider. An orders.read scope does not permit payment cancellation, and an administrator role cannot repair an audience mismatch.
Delegated tokens act on behalf of a user; application tokens can represent the application itself. Do not invent a human identity in a client-credentials flow. If an endpoint accepts both models, define actor and permission rules explicitly. Parse scopes according to the provider’s contract rather than substring matching.
Request minimal scopes. A token’s operation permission does not automatically remove ownership restrictions. Check target API, action and resource boundary separately. Distinguish these failures in internal diagnostics without exposing unnecessary detail externally.
For permission models spanning several APIs and integrations.
Using audience, role and scope interchangeably.
One topic. Three levels of depth.
aud=orders-api; scope=orders.readThe target can be correct while write permission is absent.
This page does not send requests to external servers. Messages are readable HTTP/1.1 illustrations, not HTTP/2 or HTTP/3 wire dumps. example.test is reserved for examples. Run commands and JavaScript only in your own test environment; never publish real tokens or cookies.
Try it yourself first.
A token with orders.read calls DELETE /orders/42. Is valid authentication sufficient?
Show the solution and explanation
No: require the operation permission and resource policy.No. Read scope does not grant delete permission.