# Surface custom scopes on consent screen for first-party applications

**URL:** <https://community.auth0.com/t/surface-custom-scopes-on-consent-screen-for-first-party-applications/86291>\
**Category:** Get Help\
**Tags:** oauth2\
**Created:** [July 1, 2022, 5:23pm UTC](https://community.auth0.com/t/surface-custom-scopes-on-consent-screen-for-first-party-applications/86291 "2022-07-01T17:23:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ian-ridian](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ian-ridian/32/38528_2.png) [@ian-ridian](https://community.auth0.com/u/ian-ridian)\
**Post date:** [July 1, 2022, 5:23pm UTC](https://community.auth0.com/t/surface-custom-scopes-on-consent-screen-for-first-party-applications/86291/1 "2022-07-01T17:23:37Z")

</div>

Is this possible?

I set up an application (as regular web app), an API (added two custom scopes and kept consent enabled), and a test user (assigned to my application with custom scopes/permissions assigned). So far, only the `profile` scope shows up on the consent screen.

I am reading that custom scopes surface on third-party applications by default, so I’ve also followed this [article](https://auth0.com/docs/get-started/applications/confidential-and-public-applications/enable-third-party-applications) in converting a first-party app to a third-party app, but the custom scopes aren’t surfacing on consent nor is it included in the `access_token`.

Thank you in advance!

---

<div class="post-metadata">

**Author:** ![ian-ridian](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ian-ridian/32/38528_2.png) [@ian-ridian](https://community.auth0.com/u/ian-ridian)\
**Post date:** [July 4, 2022, 9:23pm UTC](https://community.auth0.com/t/surface-custom-scopes-on-consent-screen-for-first-party-applications/86291/2 "2022-07-04T21:23:37Z")

</div>

Circling back on what I ended up having to do:

I needed to pass the `audience` param in the authorization request. I’m using using `authlib`, `OAuth2Session` (rather parent class `OAuth2Client`) defines the following

```auto
class OAuth2Client(object):
    # other stuff

    EXTRA_AUTHORIZE_PARAMS = (
        'response_mode', 'nonce', 'prompt', 'login_hint',
    )

```

and does NOT include `audience`, so I needed to extend it:

```auto
class OAuth2SessionProxy(OAuth2Session):
    """
    need to extend OAuth2Session in order to include the `audience`
    param in the OAuth2Session.EXTRA_AUTHORIZE_PARAMS tuple, it's used
    by Auth0 in determining which API this request is associated with
    """
    def __init__ (self, *args, **kwargs):
        super(OAuth2SessionProxy, self). __init__ (*args, **kwargs)

    EXTRA_AUTHORIZE_PARAMS = (
        'response_mode',
        'nonce',
        'prompt',
        'login_hint',
        'audience',
    )

```

Anyway, this is what worked for me. Interested in hearing if anyone ran into something similar / what their approach was.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [November 4, 2022, 1:50pm UTC](https://community.auth0.com/t/surface-custom-scopes-on-consent-screen-for-first-party-applications/86291/3 "2022-11-04T13:50:04Z")

</div>