# Do Forge apps in dev environments really get all available OAuth 2.0 scopes?

**URL:** <https://community.developer.atlassian.com/t/do-forge-apps-in-dev-environments-really-get-all-available-oauth-2-0-scopes/86665>\
**Category:** Forge Platform and Tools\
**Tags:** permissions, scopes, forge\
**Created:** [November 27, 2024, 10:30am UTC](https://community.developer.atlassian.com/t/do-forge-apps-in-dev-environments-really-get-all-available-oauth-2-0-scopes/86665 "2024-11-27T10:30:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tbinna](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/tbinna/32/35870_2.png) [@tbinna](https://community.developer.atlassian.com/u/tbinna)\
**Post date:** [November 27, 2024, 10:30am UTC](https://community.developer.atlassian.com/t/do-forge-apps-in-dev-environments-really-get-all-available-oauth-2-0-scopes/86665/1 "2024-11-27T10:30:29Z")

</div>

I just noticed [in the Forge permission docs (blue info box) it says](https://developer.atlassian.com/platform/forge/manifest-reference/permissions/#scopes):

> Forge apps deployed in the _development_ environment always receive all available OAuth 2.0 scopes

Is this is really true? This is new to me. It would mean any declared scopes are irrelevant until you deploy to staging or production and you can only really test scopes in staging or production environments.

I would appreciate it if anyone could help to clarify.

---

<div class="post-metadata">

**Author:** ![BoZhang](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/bozhang/32/51055_2.png) [@BoZhang](https://community.developer.atlassian.com/u/BoZhang)\
**Post date:** [November 27, 2024, 10:15pm UTC](https://community.developer.atlassian.com/t/do-forge-apps-in-dev-environments-really-get-all-available-oauth-2-0-scopes/86665/2 "2024-11-27T22:15:01Z")

</div>

Hi @tbinna, thanks for bringing this up!  
This doesn’t look right… an app deployed in the development environment **does not** get all available OAuth scopes by default. let me chase this one up.

---

<div class="post-metadata">

**Author:** ![ForgedApps](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/forgedapps/32/51439_2.png) [@ForgedApps](https://community.developer.atlassian.com/u/ForgedApps)\
**Post date:** [November 30, 2024, 10:34pm UTC](https://community.developer.atlassian.com/t/do-forge-apps-in-dev-environments-really-get-all-available-oauth-2-0-scopes/86665/3 "2024-11-30T22:34:39Z")

</div>

I can confirm from testing that it is _not_ true, as you will get the appropriate permission denial errors without the proper scopes. I was pretty confused by that line in the docs as well.

---

<div class="post-metadata">

**Author:** ![BoZhang](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/bozhang/32/51055_2.png) [@BoZhang](https://community.developer.atlassian.com/u/BoZhang)\
**Post date:** [December 1, 2024, 11:43pm UTC](https://community.developer.atlassian.com/t/do-forge-apps-in-dev-environments-really-get-all-available-oauth-2-0-scopes/86665/4 "2024-12-01T23:43:09Z")

</div>

Hi, sorry about that, I have removed the statement from our docs.