# Custom OAuth scopes

Clerk now gives you finer control over the access that MCP clients can request from your API. Define custom OAuth scopes in the Clerk Dashboard to match the actions and resources your API supports.

For example:

- `messages:read`
- `tools:execute`
- `resources/files:read`
- `mcp_all`

Assign only the scopes that each OAuth application needs. Separately, choose which scopes to advertise through Clerk's OAuth metadata so MCP clients can discover what your application supports.

Open the **Scopes** tab on the [**OAuth applications**](https://dashboard.clerk.com/~/oauth-applications) page to get started.

To enforce scopes in your API, verify each OAuth access token and check its granted scopes. See [Verify OAuth tokens with Clerk](https://clerk.com/docs/guides/configure/auth-strategies/oauth/verify-oauth-tokens.md).