You might be familiar with OAuth scopes from for example the Github dialog for creating a new access token. You get to choose what the token is authorized to do: can the user manage repos? Leave reviews? Push commits? There are a ton of options. Similarly Mastodon has scopes such as “see favorites” or “post on your behalf.”
![padlock on black metal fence](https://blog.valerauko.net/wp-content/uploads/2022/12/dd6n63h9szw-1024x735.jpg)