User notification OAuth scope has unexpected behavior for account linking app

Per the App Categories and Scope Details section of the Creator Third Party App Policy support article, account linking tools are allowed to use the openid, profile, and user.user-notification:write scope. When the user.user-notification:write scope is included in the authorization flow, the user is prompted to select one of their own games to authorize the third party app to send notifications from to other users on their behalf. This type of scope does not make sense for an account linking tool.

Expected behavior

When I first saw the user.user-notification:write scope, I expected that it would allow the third party app to send Roblox notifications directly to the user who is authorizing the app. This would be especially useful for notifying when something changes or happens on the third-party app, as it is currently not possible for normal apps to request the email scope.

1 Like

This reads more like a feature request than a bug report to me.

1 Like

We’ll look into this, it does seem like we made a mistake here in assessing the endpoint’s functionality at a glance. Thanks for letting us know.

2 Likes