# Breaking OAuth Change: Scopes must be set on post auth

**URL:** <https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320>\
**Category:** API Feedback\
**Created:** [October 4, 2019, 2:53am UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320 "2019-10-04T02:53:45Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![cynicaloptimist](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/cynicaloptimist/32/440_2.png) [@cynicaloptimist](https://www.patreondevelopers.com/u/cynicaloptimist)\
**Post date:** [October 4, 2019, 2:53am UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/1 "2019-10-04T02:53:45Z")

</div>

My users are currently getting an error when trying to login through Patreon OAuth:

{“error”:“Scopes must be set on post auth.”}

I haven’t made any changes to my app; this started happening a few minutes ago. The API documentation has always listed scopes as optional:

[https://docs.patreon.com/#step-2-making-the-log-in-button](https://docs.patreon.com/#step-2-making-the-log-in-button)

Please fix this ASAP. Thanks!

---

<div class="post-metadata">

**Author:** ![cynicaloptimist](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/cynicaloptimist/32/440_2.png) [@cynicaloptimist](https://www.patreondevelopers.com/u/cynicaloptimist)\
**Post date:** [October 4, 2019, 2:58am UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/2 "2019-10-04T02:58:47Z")

</div>

I’m deploying an emergency fix to apply scopes to the OAuth call.

This is the second time that a change on Patreon’s end has required me to deploy a fix to mitigate it. Earlier this year I lost the ability to look up my own Patreon posts from the API: [API Returning Cloudflare Challenge](https://www.patreondevelopers.com/t/api-returning-cloudflare-challenge/2025)

---

<div class="post-metadata">

**Author:** ![umhoops](https://avatars.discourse-cdn.com/v4/letter/u/e9bcb4/32.png) [@umhoops](https://www.patreondevelopers.com/u/umhoops)\
**Post date:** [October 4, 2019, 1:14pm UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/3 "2019-10-04T13:14:21Z")

</div>

I am also receiving this error and it is causing issues with my users. Can someone please clarify why this breaking change was implemented and what I can do to fix the issue?

---

<div class="post-metadata">

**Author:** ![codebard](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/codebard/32/14_2.png) [@codebard](https://www.patreondevelopers.com/u/codebard)\
**Post date:** [October 4, 2019, 1:16pm UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/4 "2019-10-04T13:16:46Z")

</div>

Are you people using API v1 or API v2?

---

<div class="post-metadata">

**Author:** ![umhoops](https://avatars.discourse-cdn.com/v4/letter/u/e9bcb4/32.png) [@umhoops](https://www.patreondevelopers.com/u/umhoops)\
**Post date:** [October 4, 2019, 1:18pm UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/5 "2019-10-04T13:18:21Z")

</div>

I’m using API V1… When a user clicks Login With Patreon button on my site and is redirected back they get this:

{“error”:“Scopes must be set on post auth.”}

---

<div class="post-metadata">

**Author:** ![Vortex00](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/vortex00/32/1076_2.png) [@Vortex00](https://www.patreondevelopers.com/u/Vortex00)\
**Post date:** [October 4, 2019, 3:13pm UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/6 "2019-10-04T15:13:13Z")

</div>

adding the scope parameter to the button fixed it for me  
`&scope=users%20pledges-to-me%20my-campaign`

---

<div class="post-metadata">

**Author:** ![emoses](https://avatars.discourse-cdn.com/v4/letter/e/ccd318/32.png) [@emoses](https://www.patreondevelopers.com/u/emoses)\
**Post date:** [October 4, 2019, 5:10pm UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/7 "2019-10-04T17:10:45Z")

</div>

Hi folks, this was an unintentional change. A fix is in progress and will be released soon.

---

<div class="post-metadata">

**Author:** ![SolFolango](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@SolFolango](https://www.patreondevelopers.com/u/SolFolango)\
**Post date:** [October 4, 2019, 5:41pm UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/8 "2019-10-04T17:41:52Z")

</div>

I am having issues with logins using API v2, too, is this a result of your intententional change, too? Please refer to this post: [Patreon oauth2 resulting in 500 on patreon side](https://www.patreondevelopers.com/t/patreon-oauth2-resulting-in-500-on-patreon-side/2322).

My users cannot access my content until this is fixed and puts me into a shitty position.

---

<div class="post-metadata">

**Author:** ![emoses](https://avatars.discourse-cdn.com/v4/letter/e/ccd318/32.png) [@emoses](https://www.patreondevelopers.com/u/emoses)\
**Post date:** [October 4, 2019, 6:28pm UTC](https://www.patreondevelopers.com/t/breaking-oauth-change-scopes-must-be-set-on-post-auth/2320/9 "2019-10-04T18:28:07Z")

</div>

Hi folks, the fix has been released and you should no longer be seeing errors with authorize requests. Please reply here or contact Patreon support if you see any more errors.