Recently, I am working on creating a chrome extension, and we can declare OAuth2 object with client_id and scopes in the manifest file.
After that, when I am setting up the OAuth consent screen in the Google Console, I also found out that we can include the scopes that we want.
I want to ask what's the differences or usage between both of them.
In oauth2 scopes define the limit of authorization you are requesting from a user. Remember authentication is login, oauth2 is authorization. Your application is requesting authorization to access a users data.
Each method in an api will require different set of authorization in order to access the data.
Method which only request access to read data like a users profile, will typically only require read only access.
Methods which require access to write to the users data say adding an event in the users calendar will require write access.
The following is a list scopes