New logic for updating scopes on existing apps

Apps can now update their OAuth scopes without automatically having the app uninstalled for all existing users.

The process will now work as follows:

Apps (draft/private, unlisted and public) can update their scopes at any time.

When the scopes have been updated, existing users will receive a notification email letting them know of the change in scopes and asking them to reauthorize the app.

Apps that decide to update their scopes must be able to clearly direct users to reauthorize the app in the Marketplace. This must be done to allow users to use the app in its full capacity. The scopes change will not halt the app's functionality - the features built with previous scopes will continue working.

From the Marketplace side, the app listing will remain available and won’t be sent back into the app approval process. The scopes displayed in the installation screen of the app listing will be automatically updated to reflect the new scopes.

The user has the option to either accept or deny all scopes. Because of this, it's a good idea to build apps that only request scopes that are absolutely necessary for your particular use-case. You can see the list of available OAuth scopes here.

Published on October 30, 2020