26.08.2026
12:47
When using an OAuth2 App → API authentication with the Client Credentials Grant, WEBCON always seems to include the scope parameter in the token request, even if no scopes are configured.
Configuration:
Authentication type: OAuth2 App → API
Grant type: Client Credentials
Scopes: none configured
WEBCON BPS: 2026.2.1.62
We captured the actual token request sent by WEBCON. The form parameters are:
grant_type=client_credentials
client_id=<client_id>
client_secret=<client_secret>
scope=
The relevant part is the last parameter:
scope=
There seems to be no option in the authentication configuration to completely omit this parameter.
This causes an interoperability issue with APIs that use strict request validation. In our case, the OAuth token endpoint defines only the following form parameters:
grant_type
client_id
client_secret
Additional properties are not accepted.
The behavior is reproducible independently of WEBCON:
POST with:
grant_type
client_id
client_secret
→ HTTP 200, token returned
Adding an empty scope:
POST with:
grant_type
client_id
client_secret
scope=
→ HTTP 400 VALIDATION_ERROR
Therefore, the Client Credentials flow itself works correctly; the only problem is the additional empty scope parameter sent by WEBCON.
Suggested improvement
If no scopes are configured, WEBCON should either:
omit the scope parameter completely, or
provide an option such as “Do not send empty scope” in the OAuth2 App → API authentication configuration.
According to OAuth 2.0, the scope parameter in an access token request is optional, so omitting it when no scope has been configured would also seem to be the more appropriate default behavior.
Is there currently any way to prevent WEBCON from sending scope= in the token request?
