Tokens
OAuth scope drift in fintech APIs
Scope drift rarely arrives as a dramatic breach. It arrives as a product ticket that “just needs one more claim” so a mobile release can ship. Six months later, a client meant for read-only card status can also trigger secondary actions nobody re-approved.
Where to look first
Compare declared scopes in the developer portal, actual grants in the authorization server, and routes protected by the gateway. Mismatches among those three are your highest-yield audit leads. Service accounts deserve a separate pass — they accumulate privileges quietly because humans rarely log in as them.
Refresh and consent theater
Some stacks re-consent on paper while refresh tokens continue to carry older, wider scopes. Confirm whether scope reduction requires token revocation or merely a new consent record that production never enforces.
Checklist habits
Pick a fixed interval for scope inventory diffs. Treat unexplained expansions as findings even when “nobody abused them yet.” Drift is a control failure before it is an incident.
Module 4 of our flagship course practices this diff on a fictional wallet API. For private delivery on your own map, ask about Continuity Desk.