Scopes
What each word opens, and why the list is short.
A scope is added on the day the thing it guards starts checking for it, not on the day somebody imagines the feature. That is not tidiness: a consent screen listing something nothing honours teaches people that agreeing is a formality, and the next screen they click through is the one that mattered.
So the list below is generated from the same document the libraries are, and every operation named under a word is an operation that actually checks for it.
Ask for the fewest you can. A person reading a consent screen with two words on it reads both; one with nine reads none.
catalog:read #
Looking things up, and nothing about anybody.
GET/calendarGET/characters/{id}/titlesGET/characters/{id}/voicesGET/characters/{id}GET/people/{id}GET/titles/{id}GET/genresGET/titlesGET/people/{id}/charactersGET/people/{id}/titlesGET/titles/randomGET/titles/{id}/relatedGET/charactersGET/peopleGET/titles/{id}/similarGET/titles/{id}/charactersGET/titles/{id}/episodesGET/titles/{id}/screenshotsGET/titles/{id}/staff
email #
The address on the account, and whether it is confirmed.
Nothing under /api/v1 checks for this one — it is about the sign-in itself
rather than about an endpoint.
lists:read #
What this person is watching, planning, and has finished, and the shelves they named.
lists:write shown apart #
Adding titles, stepping episodes, rating, and making shelves — in their name.
Writing as somebody is one of the two a person should have to look at twice, so the consent screen shows it apart from the rest.
offline_access #
A refresh token, so the application can act while nobody is watching. Without it there is none.
Nothing under /api/v1 checks for this one — it is about the sign-in itself
rather than about an endpoint.
openid #
Makes this an identity request rather than a plain OAuth one. Without it no id token is minted.
Nothing under /api/v1 checks for this one — it is about the sign-in itself
rather than about an endpoint.
people:read #
Everybody else, as far as they have agreed to be read — public profiles, their lists and shelves, who follows whom.
profile #
The nickname, the picture, the banner, the line under the name, and the day the account was made.
social:read #
This person's own posts and who they read. Not everybody's.
social:write shown apart #
Writing posts and following people, in their name.
Writing as somebody is one of the two a person should have to look at twice, so the consent screen shows it apart from the rest.