# Feature SI-247 - Enable restricted scopes for JWT

Project: Stream Integration Basics
Status: new
URL: https://community.openproject.org/work_packages/SI-247

## Planning

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Target versions | Product Backlog |
| Votes |  |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

_No work packages_

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module | Authentication, API |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |
| Accessibility | No |

## People

| Attribute | Value |
| --- | --- |
| Assignee | OP Dev Titan Team |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| PD (min) |  |
| PD (max) |  |
| Work |  |
| Labor costs |  |

## Description

**As** an admin  
**I want to** be able to pass additional scopes into JWTs,  
**so that** I can restrict the capabilities of tokens handed out via OIDC.

**Acceptance criteria**

  - OpenProject reads additional scopes of a JWT, similar to what was implemented for internal Doorkeeper tokens (see <https://github.com/opf/openproject/pull/25879> - not yet merged at time of writing)

  - Those scopes are passed to APIs relying on the JWT strategy as well
    
      - in other words: Assuming [PR 25879](https://github.com/opf/openproject/pull/25879) is merged, a scope like `op:resource:documents:edit` has the same effect in a JWT that it already has in a doorkeeper-based token

**Technical notes**

  - This is probably needed for <mention class="mention" data-id="83366" data-type="work_package" data-text="###COMMS-1122" data-display-id="COMMS-1122">\#\#\#COMMS-1122</mention>. If it's not implemented when we start working on this, the COMMS team will probably implement it.

**Permissions and visibility considerations**

  - *To whom is this feature visible?*

  - *When is it not visible?*

**Translation considerations**

  - *Key terms and phrases in the key languages*

**Out of scope**

  - 
    <br>

*Set the* **To be informed/consulted teams** *field to include all teams necessary to be informed of the changes.*