Okta Generates an illegal_scope_combination Error During OAuth 2.0 and OIDC Authorization
Last Updated:
Overview
An illegal_scope_combination error occurs when an OAuth 2.0 or OpenID Connect (OIDC) client application requests mutually incompatible scopes. Update the client application configuration to request only the specific scopes that the intended flow requires to resolve this issue. Users fail to authenticate to an integration or client application via OAuth 2.0 or OIDC because the authorization request fails with the following error:
illegal_scope_combination
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- API Access Management
- Custom Authorization Servers
- OAuth 2.0 and OpenID Connect (OIDC) applications
Cause
This error occurs when an OAuth 2.0 or OIDC client application requests two or more mutually incompatible scopes in the same authorization request. Some scopes available in Okta Authorization Servers facilitate distinct, non-overlapping flows. When a client requests these scopes simultaneously, Okta rejects the combination because the underlying flows cannot coexist in a single authorization context. Common examples of incompatible scope pairs include:
interclient_access: Facilitates Native to Web Single Sign-On (SSO) token exchange.device_sso: Facilitates Native SSO across native applications on a device.
Requesting both scopes in the same payload triggers the error. Okta enforces this restriction because these scopes represent mutually incompatible authentication flows.
Additionally, as administrators enable features on an organization, Okta automatically adds new scopes to the scopes_supported list in the Authorization Server .well-known/openid-configuration or .well-known/oauth-authorization-server metadata. If a client application dynamically requests all advertised scopes, the application may unintentionally includes incompatible combinations.
NOTE: This issue surfaces more frequently when administrators enable Early Access or organization-specific features, as these introduce additional scopes (such as interclient_access) into the authorization server public metadata. If an organization recently enabled a new feature and encounters this error, review the new scopes added to scopes_supported and verify whether the client application requests them.
Solution
Okta does not support configurations to suppress, delete, or exclude scopes from the Authorization Server public metadata, and administrators cannot bypass this scope compatibility check. Resolve the issue by updating the OIDC client application configuration to request only the specific scopes required for the intended flow.
How do administrators resolve the illegal_scope_combination error?
Audit the requested scopes and remove unnecessary scopes from the application flow by reviewing the client application configuration.
- Review the scopes requested by the client application.
- Remove any scopes that the application flow does not require.
- Configure the application to request only the necessary scopes.
Review the following example request:
scope: "openid profile email offline_access"NOTE: Do not configure client applications to request scopes simply because they appear in the authorization server metadata.
