# OAuthScope

OAuth scopes that are allowed with this client.

- Source: [`aws-cognito/lib/user-pool-client.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-cognito/lib/user-pool-client.ts#L134)

## Example

```ts
const pool = new cognito.UserPool(this, 'Pool');

const readOnlyScope = new cognito.ResourceServerScope({ scopeName: 'read', scopeDescription: 'Read-only access' });
const fullAccessScope = new cognito.ResourceServerScope({ scopeName: '*', scopeDescription: 'Full access' });

const userServer = pool.addResourceServer('ResourceServer', {
  identifier: 'users',
  scopes: [ readOnlyScope, fullAccessScope ],
});

const readOnlyClient = pool.addClient('read-only-client', {
  // ...
  oAuth: {
    // ...
    scopes: [ cognito.OAuthScope.resourceServer(userServer, readOnlyScope) ],
  },
});

const fullAccessClient = pool.addClient('full-access-client', {
  // ...
  oAuth: {
    // ...
    scopes: [ cognito.OAuthScope.resourceServer(userServer, fullAccessScope) ],
  },
});
```

## Properties

- `COGNITO_ADMIN`: [OAuthScope](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.OAuthScope.html) (static) — Grants access to Amazon Cognito User Pool API operations that require access tokens, such as UpdateUserAttributes and VerifyUserAttribute.

- `EMAIL`: [OAuthScope](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.OAuthScope.html) (static) — Grants access to the 'email' and 'email_verified' claims.

  Automatically includes access to `OAuthScope.OPENID`.

- `OPENID`: [OAuthScope](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.OAuthScope.html) (static) — Returns all user attributes in the ID token that are readable by the client.

- `PHONE`: [OAuthScope](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.OAuthScope.html) (static) — Grants access to the 'phone_number' and 'phone_number_verified' claims.

  Automatically includes access to `OAuthScope.OPENID`.

- `PROFILE`: [OAuthScope](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.OAuthScope.html) (static) — Grants access to all user attributes that are readable by the client Automatically includes access to `OAuthScope.OPENID`.

- `scopeName`: string — The name of this scope as recognized by CloudFormation.

## Methods

- `custom(name: string): OAuthScope // chainable` (static) — Custom scope is one that you define for your own resource server in the Resource Servers.

  The format is 'resource-server-identifier/scope'.

- `resourceServer(server: IUserPoolResourceServer, scope: ResourceServerScope): OAuthScope // chainable` (static) — Adds a custom scope that's tied to a resource server in your stack.