A scope names one specific permission a token carries, like read:orders or write:orders, rather than granting blanket access to everything the account could do.

A client requests only the scopes its features actually need. Before allowing a request, the resource server checks the scopes granted to the token against the scopes the endpoint requires.

If a client requests more scopes than it needs, a leaked token does more damage. A token holding only read:orders exposes far less than a token with full access to the account, even when both belong to the same user.