OAuth Scope Formatter
Normalize an OAuth 2.0 scope list (RFC 6749 §3.3): split on ASCII whitespace only, drop duplicates, flag invalid scope-tokens, and re-emit as the SP wire form, one per line, or JSON.
This tool handles input and primary processing in your browser and is designed not to send the input to QuickKit’s server.
Formatted scopes
| Space-delimited (RFC 6749 wire form) | — |
|---|---|
| One per line | — |
| JSON array | — |
| Scope count | — |
| Duplicates removed | — |
| Invalid tokens (break the scope-token grammar) | — |
How it works
An OAuth 2.0 `scope` parameter (RFC 6749 §3.3) is a space-separated list of scope-tokens, and order carries no meaning. A scope-token is `1*( %x21 / %x23-5B / %x5D-7E )` — any printable US-ASCII character except space, double quote ("), and backslash (\). A comma (%x2C) falls inside that range, so a comma is a legal character *within* a scope-token: `read,write` is one token, not two. This tool therefore splits only on ASCII whitespace — SP, plus HTAB, CR, and LF as a paste convenience. An NBSP or other Unicode space is not a separator; it stays part of the token, which then shows up as an invalid scope-token rather than being silently split. The formatter removes duplicate scopes (toggle off to keep them), optionally sorts them, lists any tokens that break the scope-token grammar, and outputs the result as the space-delimited wire form, one per line, and a JSON array. There is no comma-separated output: since a comma can appear inside a scope-token, it could not preserve the scope boundaries. Scopes are configuration, not secrets, but this tool still runs entirely in your browser.