When assigning scopes for a Legacy Package API Integration, what is recommended?

• A. Do not assign any scope
• B. Assign the Marketing Cloud scope and only the scope needed
• C. Always include all scopes
• D. Scope is optional

Answer: (B)

Granting OAuth scopes for a Legacy Package API Integration should follow the principle of least privilege: you provide enough access for the integration to work, but no more. The recommended approach is to include the Marketing Cloud scope and then add only the specific scopes that your integration actually needs. This ensures the token can access the necessary Marketing Cloud resources while limiting exposure to unnecessary permissions, reducing security risk.

Not assigning any scope would block access to the APIs. Treating scope as optional is incorrect because the token must be explicitly scoped to authorize actions. Including all scopes is unnecessary and broadens access beyond what the integration requires, which is discouraged in favor of minimal permissions.