Having problems with supplying scope to Kinde API

I eventually figured it out. The 'Postman' instructions were wrong (or at least Kinde doesn't operate the way Postman expects) when it comes to scope submissions. By default Postman will include scopes in the body, which Kinde rejects with the above error message. However, if you empty out the scopes and manually modify the request (using a similar process to the Kinde instructions on populating the audience, but instead add scopes to the header it works.

Hey @Stephen I'd love to update our docs so others don't encounter this. Can confirm that the modification need to be about:

• clarifying scopes need to be in the header
• To remove any existing scopes in Postman

Thanks @Claire_Kinde I think it might need to go back to your engineering team to clarify. If most providers are putting (or at least supporting) scopes in the body then I would argue Kinde should fall in line with industry practice. I created another issue in the #🪲┃bug-reports channel and it looks like for M2M Kinde doesn't even look at the scopes, as long as the app is authorised for the scope, then it's allowed. I'm not sure what industry practice is here but I would suggest it's probably a combination of whatever OAuth 2.0 expects (or is generally agreed upon by vendors) and possibly some documentation updates.

Thanks @Stephen I'll forward your comment to an engineer and see if I can come back to you with an explanation why we might have chosen to do things a certain way. As this isn't a blocker for you, a response might take time. Thanks for your feedback.