> The scope value of only the very first request by an application is respected. If an application initially requests only the name scope, and the user allows it, it is then impossible to later also request the email scope.
So if you don't ask for the user's email right up front, you can never ask for it again later?!
How is it not? Consent to releasing information should be supported on a granular on-demand level. If I initially only need name, I'll ask the user to consent for that. If I later on need an email (lets say for some additional functionality user is trying to access), I'll ask for email separately. This is much better than being constrained to only the initial scope being respected, resulting everyone basically request everything right away, faced with a situation where they can't do it later.
You sign up for a product. No email is requested/provided.
You might later want:
- to submit a support request and receive a response via email.
- to get blog posts or product updates in your email.
- to receive a transaction receipt
Trust is earned over time. I would much rather grant granular scopes as a product builds trust.
Even from a user standpoint... oops I clicked the "cancel" button when I meant to click "confirm" and now I have to go through the signup process all over again because the developer is not allowed to ask me again.
> The scope value of only the very first request by an application is respected. If an application initially requests only the name scope, and the user allows it, it is then impossible to later also request the email scope.
So if you don't ask for the user's email right up front, you can never ask for it again later?!