# Dynamic Client Registration: assigned default vs optional scopes

**URL:** <https://forum.keycloak.org/t/dynamic-client-registration-assigned-default-vs-optional-scopes/13043>\
**Category:** Securing applications\
**Tags:** oidc\
**Created:** [January 13, 2022, 1:03pm UTC](https://forum.keycloak.org/t/dynamic-client-registration-assigned-default-vs-optional-scopes/13043 "2022-01-13T13:03:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![asoorm](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/asoorm/32/4711_2.png) [@asoorm](https://forum.keycloak.org/u/asoorm)\
**Post date:** [January 13, 2022, 1:03pm UTC](https://forum.keycloak.org/t/dynamic-client-registration-assigned-default-vs-optional-scopes/13043/1 "2022-01-13T13:03:22Z")

</div>

We have concept of “Assigned Default Client Scopes” and “Assigned Optional Client Scopes” in Keycloak. This allows a client to automatically get the scope when hitting the token endpoint, vs explicitly requesting the scope.

In a Dynamic Client Registration request, is it possible to control whether whether the scope is automatically applied vs whether a client has to request that scope?

```auto
{
  "client_name": "sample",
  "token_endpoint_auth_method": "private_key_jwt",
  "token_endpoint_auth_signing_alg": "HS256",
  "jwks_uri": "URI of the JSON web key set",
  "redirect_uris": ["http://localhost"],
  "response_types": ["none"],
  "grant_types": ["client_credentials"],
  "subject_type": "public",
  "scope": "default optional"
}

```

---

<div class="post-metadata">

**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\
**Post date:** [January 13, 2022, 2:18pm UTC](https://forum.keycloak.org/t/dynamic-client-registration-assigned-default-vs-optional-scopes/13043/2 "2022-01-13T14:18:43Z")

</div>

I bet you are using `openid-connect` provider for client registration -  
Doc: [Securing Applications and Services Guide](https://www.keycloak.org/docs/latest/securing_apps/#_client_registration)

Unfortunately, OIDC client model doesn’t have concept of default/optional scopes, only scopes: [keycloak/OIDCClientRepresentation.java at main · keycloak/keycloak · GitHub](https://github.com/keycloak/keycloak/blob/main/core/src/main/java/org/keycloak/representations/oidc/OIDCClientRepresentation.java)

I would use `default` provider, where you can use Keycloak client model - it has those properties for the config:

```auto
    "defaultClientScopes": [],
    "optionalClientScopes": []

```

See: [keycloak/ClientRepresentation.java at main · keycloak/keycloak · GitHub](https://github.com/keycloak/keycloak/blob/main/core/src/main/java/org/keycloak/representations/idm/ClientRepresentation.java)