**As** Begin of the deletion a provider ofEnd of the deletion an Begin of the insertionadminEnd of the insertion Begin of the deletion APIEnd of the deletion
**I want to** be able to Begin of the insertionpass additional scopes into JWTs,End of the insertion Begin of the deletion handle out tokens that are restricted to certain endpointsEnd of the deletion
**so that** Begin of the insertionI can restrict the capabilities of tokens handed out via OIDC.End of the insertion Begin of the deletion it is more secureEnd of the deletion

**Acceptance criteria**

* Begin of the insertionOpenProject reads additional scopesEnd of the insertion Begin of the deletion It is possible to restrict the scopeEnd of the deletion of a Begin of the insertionJWT,End of the insertion Begin of the deletion JWT token,End of the deletion similar to what was implemented for Begin of the insertioninternal DoorkeeperEnd of the insertion Begin of the deletion OAuthEnd of the deletion tokens (see [https://github.com/opf/openproject/pull/25879](https://github.com/opf/openproject/pull/25879) - not yet merged at time of writing)

* Begin of the insertionThoseEnd of the insertion Begin of the deletion The same naming scheme forEnd of the deletion scopes Begin of the insertionare passed to APIs relying onEnd of the insertion Begin of the deletion should be used withEnd of the deletion the JWT Begin of the deletion OidEnd of the deletion strategy Begin of the insertionas well

* in other words: Assuming [PR 25879](https://github.com/opf/openproject/pull/25879) is merged, a scope like `op:resource:documents:edit` has the same effect in a JWT that it already has in a doorkeeper-based token


End of the insertion Begin of the deletion


End of the deletion **Technical notes**

* This is probably needed for&nbsp;<mention class="mention" data-id="83366" data-type="work_package" data-text="###COMMS-1122" data-display-id="COMMS-1122">###COMMS-1122</mention>. If it&#x27;s not implemented when we start working on this, the COMMS team will probably implement it.


**Permissions and visibility considerations**

* _To whom is this feature visible?_

* _When is it not visible?_


**Translation considerations**

* _Key terms and phrases in the key Begin of the insertionlanguages_End of the insertion Begin of the deletion languages_ End of the deletion


**Out of scope**

* <br>


_Set the_ **To be informed/consulted teams** _field to include all teams necessary to be informed of the changes._