Security & abuse

Should I use scopes if I only have one endpoint?

Example Written by the BuildAPI team to answer a common question.
BT
BuildAPI team
Example
Question

Docs say scopes are optional. I have one endpoint and one key. Is there any point?

BT
BuildAPI team
Example

Not really today, and that's a fine answer. Scopes earn their keep the moment you have a second thing the key could do and you want one caller to only do the first.

What I'd say is: leave the scope check in your call now even if the key has every scope. Adding the parameter later, across a codebase, is the annoying part. Passing it when it always passes costs nothing.