Agent Wranglers

API security Required

Grant narrow scopes

Give each token only the scopes its job needs, and check the scope on every endpoint.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Define scopes per resource and action, such as orders:read and orders:write. Declare the scope each operation needs in the contract. Answer 403 with a problem naming the missing scope, and with WWW-Authenticate: Bearer error="insufficient_scope" as RFC 6750 defines.

How to check

Call POST /orders with an orders:read token. The answer is 403 and names orders:write.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/token-scopes.