Yaak Logo
Yaak
Feedback/OAuth 2 scope should only be sent on authorize

OAuth 2 scope should only be sent on authorize

Tia Heinrich·Aug 17, 2026 08:40:35 UTC·YK-1064
ReleasedBug

Currently I am not able to use OAuth 2 auth (grant type: Authorization Code) against an OpenIddict server. It looks like the root cause is because the scope is sent not only to the authorize request, but also the access token request. That request is then outright rejected by OpenIddict.

As I cannot change anything on this server, it would be great if yaak would not send the scope for the access token request, or at least give me the option to not send it there.

As per spec the scope should not be required for the access token request: https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.3

Here is a link to some context to this particular issue I believe: https://stackoverflow.com/questions/75528130/openiddict-4-0-msal-js-fails-for-code-flow-pkce-due-to-sending-scopes

Windows2026.5.0

Comments (4)

Sign in to leave a comment.

Yaak BotReleasedFeatured

This shipped in 2026.7.0 🎉

Yaak BotReleased to Beta

This is now available in 2026.7.0-beta.5!

Tia HeinrichOP

Seems to work :) Thank you!

Gregory Schier

No problem

Type to search feedback...