# \[ New \] OAuth permission scopes **URL:** \ **Category:** Changelog\ **Tags:** authorization-api\ **Created:** [9 April 2025 23:41 UTC](https://forum.asana.com/t/new-oauth-permission-scopes/1048556 "2025-04-09T23:41:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Andrew-asana](https://luna1.co/8d76cd.png) [@Andrew-asana](https://forum.asana.com/u/Andrew-asana)\ **Post date:** [9 April 2025 23:41 UTC](https://forum.asana.com/t/new-oauth-permission-scopes/1048556/1 "2025-04-09T23:41:08Z")
## Summary We’re introducing a redesigned OAuth consent experience for new apps that supports **OAuth (permission) scopes**. This change allows developers to request the **least privileged access** necessary for their integrations, increasing both user trust and application security. Previously, apps requested full access to a user’s Asana account. With this update, developers can now specify the exact objects and actions their app requires—e.g., `tasks:read`, `projects:write`, `users:read`. We expect apps using scopes to get greater adoption amongst users, particularly [Enterprise](https://asana.com/enterprise) customers. ## Who is affected This preview release includes 14 granular scopes that can be registered for **new apps**. Existing apps will continue using full permissions until these self-serve granular scopes are made available later. If you’re building a new integration and registering granular scopes, you’ll automatically see the new scope-based consent screen. For developers using the preview, your app will request a specific list of scopes at auth time. If you need to change the permissions granted, the user must re-authorize the app. ## Timeline - **Developer** **preview** : Available _now_ for new apps - **More scopes & usability improvements** : Ongoing updates through June 2025 - **General** **availability** : Expected July 2025 By GA, we will be implementing: - [SOON] Scopes are presented alongside API endpoint documentation - Self-serve scopes registration for _existing_ apps - Developer usability improvements like a token introspection endpoint to assert scopes available to a given token - More granular scopes! ## Usage As you register your new application in the **OAuth** tab of your developer console, you can specify which OAuth scopes your app can request: ![scopes1](https://us1.discourse-cdn.com/asana/original/4X/d/6/1/d618f047bf32b12c3f6ccc3be2a447c63dd6abf9.png) In the example above, the following OAuth scopes were selected: `projects:read`, `tasks:read`, `tasks:write`, and `tasks:delete`. Keep in mind that only pre-approved scopes will be accepted during user authorization. You must explicitly specify the desired scopes using the `scope` query parameter when requesting user authorization. For example: ```html Authenticate with Asana ``` Scopes are space-separated (URL-encoded). Tokens issued will only have access to the scopes listed at authorization time. Upon visiting the authorization endpoint with the above link, the user will be greeted with a screen that looks like: ![image (1)](https://us1.discourse-cdn.com/asana/original/4X/4/a/f/4af49a381de568dc16469859a4a95317cb53918e.png) See the full [OAuth scopes documentation](https://developers.asana.com/docs/oauth-scopes) for a comprehensive guide to get started! ## Migration steps If you’re currently using “full access” and would like to preview OAuth scopes: 1. Register a new app in the [developer console](https://app.asana.com/0/my-apps). 2. Specify only [the scopes](https://developers.asana.com/docs/oauth-scopes) your app needs. 3. Update your [auth flow](https://developers.asana.com/docs/oauth#user-authorization-endpoint) to pass those scopes via the `scope` query parameter. 4. Test API requests in Postman or your app. 5. Handle `403` errors by checking for missing scopes and updating your scope list. For example, a request like ```bash GET /tasks/123?opt_fields=assignee.email ``` Will fail with a `403` unless you include the `users:read` scope. ## Why we’re making this change OAuth scopes are part of our ongoing effort to increase developer control, strengthen security, and build user trust. Implementing OAuth scopes in your applications offers several key advantages for developers: - **Granular access control** : Scopes allow you to request only the specific permissions your app needs, reducing the potential attack surface and minimizing security risks. - **Improved user trust** : By requesting minimal permissions, you create a more transparent OAuth flow, increasing user confidence in your application. - **Easier compliance** : Scopes help you adhere to the principle of least privilege, making it easier to comply with data protection regulations and security best practices. - **Streamlined enterprise approval** : Apps with well-defined, minimal scopes are easier for enterprise administrators to review and approve, potentially increasing your app’s adoption in corporate environments. ## Resources - [Asana OAuth documentation](https://developers.asana.com/docs/oauth) (updated) - [Full OAuth scopes list](https://developers.asana.com/docs/oauth-scopes) ## Questions and feedback We’d love to hear how you’re using OAuth permission scopes and what additional permissions you’d like to see. Let us know: - Along with the full scopes list above, which other scopes are you excited for? - Is the preview working as expected for your new app? - Existing app and want to use scopes? We’d be happy to [partner with you](https://form.asana.com/?k=GWXpFL29lIfO7FwCdzoidA&d=15793206719) to get your app migrated to use scopes prior to GA! - What tooling support, if any, would improve your experience? ---
**Author:** ![karthikeya\_satti](https://luna1.co/8d76cd.png) [@karthikeya\_satti](https://forum.asana.com/u/karthikeya_satti)\ **Post date:** [15 April 2025 07:51 UTC](https://forum.asana.com/t/new-oauth-permission-scopes/1048556/3 "2025-04-15T07:51:51Z")
Hey @Andrew-asana , I was not able to use the stories:read scope, it was enabled in the new asana app as well included in the authorization. The other read scopes though work as expected ---
**Author:** ![John\_Vu](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/john_vu/32/97235_2.png) [@John\_Vu](https://forum.asana.com/u/John_Vu)\ **Post date:** [17 April 2025 23:48 UTC](https://forum.asana.com/t/new-oauth-permission-scopes/1048556/4 "2025-04-17T23:48:37Z")
Hey @karthikeya_satti, I am not able to reproduce this issue with the two `stories:read` endpoints: - GET /stories/{story\_gid} - GET /tasks/{task\_gid}/stories mentioned in [OAuth scopes](https://developers.asana.com/docs/oauth-scopes#stories) Are you getting an error back? I am assuming you selected the “Read” checkbox under “Stories” form your app’s oauth page under **“Permission scopes”** ---
**Author:** ![Phil\_Seeman](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/phil_seeman/32/81525_2.png) [@Phil\_Seeman](https://forum.asana.com/u/Phil_Seeman)\ **Post date:** [19 June 2025 20:52 UTC](https://forum.asana.com/t/new-oauth-permission-scopes/1048556/5 "2025-06-19T20:52:42Z")
Split this topic on 19 June 2025 20:52 UTC 2 posts were split to a new topic: [Receiving the OAuth error “The redirect\_uri parameter does not match a valid url for the application”](https://forum.asana.com/t/receiving-the-oauth-error-the-redirect-uri-parameter-does-not-match-a-valid-url-for-the-application/1073340) ---
**Author:** ![Markus\_Winkler1](https://luna1.co/8d76cd.png) [@Markus\_Winkler1](https://forum.asana.com/u/Markus_Winkler1)\ **Post date:** [14 July 2025 07:51 UTC](https://forum.asana.com/t/new-oauth-permission-scopes/1048556/6 "2025-07-14T07:51:01Z")
Hi Andrew, @Andrew-asana we implemented an API to connect our ERP System to Asana Tasks. Sadly since this morning, you seem to have locked us out with this security feature since this morning. ## Microsoft Dynamics 365 Business Central Status: 403, Anfrage: [https://app.asana.com/api/1.0/projects/xxx/tasks?opt\_fields=assignee,\*\*custom\_fields.name,custom\_fields.display\_value\*\*&completed\_since=now](https://app.asana.com/api/1.0/projects/xxx/tasks?opt_fields=assignee, **custom_fields.name,custom_fields.display_value** &completed_since=now), Antwort: {“errors”:[{“message”:"The following scopes must be present to fulfill this request: **custom\_fields:read"** ,“help”:“For more information on API status codes and how to handle them, read the docs on errors: [Errors](https://developers.asana.com/docs/errors)”}]} You introduced a new OAuth Scope that is not supported for Apps to select / grant, which now forces me to delete all access tokens and give full access to all users after re-authorization. Can you please fix this as soon as possible (abiltiy to grant the new scope) and implement only OAuth scopes that can be granted in the future? Thanks very much. ---
**Author:** ![John\_Baldo](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/john_baldo/32/163575_2.png) [@John\_Baldo](https://forum.asana.com/u/John_Baldo)\ **Post date:** [24 July 2025 22:27 UTC](https://forum.asana.com/t/new-oauth-permission-scopes/1048556/7 "2025-07-24T22:27:56Z")
Hey @Markus_Winkler1 , Sorry for the delayed reply. Custom field read and write scopes should be available now. We tried to be up-front about this being a preview release. There may be some rough edges. But we are working on a general release that should be coming soon! Thanks for using it in preview. John ---
**Author:** ![Ludwig\_V](https://sea2.discourse-cdn.com/asana/user_avatar/forum.asana.com/ludwig_v/32/268922_2.png) [@Ludwig\_V](https://forum.asana.com/u/Ludwig_V)\ **Post date:** [9 June 2026 19:28 UTC](https://forum.asana.com/t/new-oauth-permission-scopes/1048556/8 "2026-06-09T19:28:22Z")
Is there a reason that Status Updates have been omitted from OAuth scopes? I was a bit shocked to see that there’s already handling for Timesheet approval statuses and Time tracking categories, but nothing for Status Updates. Can pull just about everything else that I could via a PAT with a view-only license except this.