---
url: https://milthm.cn/wiki/en/manual/developer/milkloud/scopes.md
description: Choose the minimum Milkloud capabilities for an OIDC grant or User Token.
---

# Scopes

Scopes grant specific capabilities to an OIDC access token or User Token. Request only the capabilities that an
integration needs. A scope name does not imply general access to the corresponding resource.

## Scope Reference

| Scope                           | Capability                       | Description                                                                                                  | Authentication   | OIDC red warning |
|---------------------------------|----------------------------------|--------------------------------------------------------------------------------------------------------------|------------------|------------------|
| `openid`                        | Identity                         | Establish the user's OIDC identity and expose identity fields such as UID and zone.                          | OIDC, User Token | No               |
| `user`                          | Profile read and nickname update | Read the current user's profile and update their nickname. Includes `profile` capabilities.                  | OIDC, User Token | Yes              |
| `profile`                       | Profile read                     | Read the current user's username, nickname, and avatar.                                                      | OIDC, User Token | No               |
| `email`                         | Email read                       | Read the current user's email address.                                                                       | OIDC, User Token | No               |
| `offline_access`                | Refresh access                   | Request refresh-token access for an approved OIDC client. The client registration must allow refresh tokens. | OIDC             | Yes              |
| `milthm:save:read`              | Cloud-save read                  | Read cloud-save metadata and request a save download URL.                                                    | OIDC, User Token | Yes              |
| `milthm:event:recent`           | Recent-score read                | Read the current user's recent score activity.                                                               | OIDC, User Token | Yes              |
| `milthm:stats:best_performance` | Best-performance read            | Read the current user's private Reality and best-performance lists.                                          | OIDC, User Token | Yes              |

The `user` scope includes `profile` capabilities, but `profile` remains a distinct scope string.
Scopes marked with an OIDC red warning show that warning during OIDC authorization.

## Request Rules

An OIDC authorization request must contain at least one of `openid`, `user`, or `profile`. Request only the additional
scopes the integration needs; the registered client controls which scopes can be granted.

The User Token screen supports every scope shown as available for **User Token** above.

See [Profile](https://milthm.cn/wiki/en/manual/developer/milkloud/profile.md), [Cloud Save](https://milthm.cn/wiki/en/manual/developer/milkloud/cloud-save.md), and [Recent Scores and Rank](https://milthm.cn/wiki/en/manual/developer/milkloud/user-scores.md) for the
endpoint-level requirements.