Vendor claim: Cloudflare announced that Wrangler and the Cloudflare API MCP server now use optional OAuth scopes. This change, posted on August 22 2026, modifies the authorization experience so developers can select which optional permissions to grant instead of automatically approving every scope requested by the client.
During the OAuth consent dialog, required scopes are pre‑selected and cannot be deselected, while optional scopes appear as checkboxes that users can enable or disable. By unchecking optional scopes, you limit the tool’s access to only the resources needed for your workflow.
If a later command or API call needs a scope you previously declined, the client will prompt you to re‑authorize and add the missing scope. This incremental approach helps enforce the principle of least privilege without breaking existing functionality.
To manage these permissions, Cloudflare points users to the wrangler login documentation and the “Edit optional permissions” guide, where you can adjust the consent screen settings for both Wrangler and the MCP server.
Overall, the optional‑scope feature gives developers finer control over their Cloudflare credentials, reducing the attack surface if a token is compromised while preserving the seamless experience of the existing tooling.