List of requested OAuth scopes, separated by spaces.
Must be a subset of scopes declared during app registration. If not provided, defaults to read.