Back

@aaronpk
OAuth question for you, if you have the time.
I was asked at work recently, regarding API Gateways and customer facing applications, if having a standard set of scopes across all APIs is a "good practice" or a "bad practice."
One concern a collegue and I voiced was that if an actor compromised one API, they have basically compromised all the APIs, since the scopes would apply across all of the end points.
Aside from that concern, are there any other reasons they should avoid this?