database - What are scope values for an OAuth2 server? -

i'm facing difficulty understand how scopes work.

i found here small text describes scopes of stackexchange api need more information on how work (not one...). can provide me concept?

thanks in advance

to authorize app need call url oauth2 authorization process. url "living" in api's provider documentation. example google has url:

https://accounts.google.com/o/auth2/auth

also need specify few query parameters link:

• cliend_id
• redirect_uri
• scope: data application requesting access to. typically specified list of space-delimited string, though facebook uses comma-delimited strings. valid values scope should included in api provider documentation. gougle tasks, scope https://www.googleapis.com/auth/tasks. if application needed access google docs, specify scope value of https://www.googleapis.com/auth/tasks https://docs.google.com/feeds
• response_type: code server-side web application flow, indivating authorization code returned application after user approves authorization request.
• state: unique value used application in order prevent cross-site request forgery (csrf) attacks on implementation. value should random unique string particular request, unguessable , kept secret in client (perhaps in server-side session)

// generate random value use 'state'.  mitigates // risk of csrf attacks when value verified against // value returned oauth provider authorization // code. $_session['state'] = rand(0,999999999);  $authorizationurlbase = 'https://accounts.google.com/o/oauth2/auth'; $redirecturipath = '/oauth2callback.php';  // example only.  valid value client_id needs obtained  // environment google apis console @  // http://code.google.com/apis/console. $queryparams = array(   'client_id' => '240195362.apps.googleusercontent.com',   'redirect_uri' => (isset($_server['https'])?'https://':'http://') .                    $_server['http_host'] . $redirecturipath,   'scope' => 'https://www.googleapis.com/auth/tasks',   'response_type' => 'code',   'state' => $_session['state'],   'approval_prompt' => 'force', // request user consent   'access_type' => 'offline' // obtain refresh token );  $gotourl = $authorizationurlbase . '?' . http_build_query($queryparams);  // output webpage directing users $gotourl after  // click "let's go" button include 'access_request_template.php'; 

the set of query string parameters supported google authorization server web server applications here:

https://developers.google.com/accounts/docs/oauth2webserver?hl=el#formingtheurl