As a Roblox developer, it is currently too hard to properly utilise the OAuth2 scopes correctly.
I use the group:view scope to retrieve user groups after they sign-in to my website via OAuth2 and currently roblox prevents using that scope because it is not consitered within the category of “Account Linking Tools”. I disagree, especially for group games where access will be considered based on group rank, not userID.
I can point out countless examples on how groups:view should fit into account linking tools, especially as it is not a dangerous permission to grant. All that is happening is the application is provided a bearer token to review the user’s groups, which is no different from the public API and just has different ratelimits.
If Roblox is able to address this issue, it would improve my development experience because it would allow myself and other developers to properly harness OAuth2 and make it a safer and cleaner experience for users of the application, as developers wouldn’t have to go out of their way to figure out how to handle requesting groups using the public API and it’s rate limits while also balancing the speediness and availability of information against that.
To put my money where my mouth is, here is a real world application of how this should be considered account linking tools.
Here’s a video of me logging into my app (using a private, testing version) using the groups:view scope to handle groups analyzing.
The site in question uses the groups:view scope to check the Access Control groups against the binded roblox group ranks, like RoVer, RoWifi, and Bloxlink do.
Here’s proof from the docker logs that this happens. I’m in a hardcoded group (group owner and select HR’s), so I inherit all permissions automatically but that’s not the point I’m making here.
Given all this, I don’t believe the scope is properly classed as it’s not afforded to the account linking tools section. Thanks!