invalid_scope
The requested
scope string contains a token outside the
closed scope list, or a refresh tried to widen
scope beyond the consent. Scope strings are space-separated,
case-sensitive <resource>:<verb> tokens.
Narrowing on refresh is allowed; widening requires a fresh trip through
/authorize.