API scope is the set of permissions an application or service is allowed to use when it calls an interface. In practice, scope determines what an API client can read, create, approve, or transfer, and what it must not touch. Security teams use scopes to apply least privilege, so a compromised token cannot automatically expose every function behind the service.
In cyber security, API scope is critical when software can trigger money movement, account changes, or administrative actions. Attackers may abuse overbroad scopes to drain wallets, place unauthorized orders, or pivot into other systems after stealing credentials. Defenders reduce this risk by separating read and write permissions, limiting scopes to specific workflows, requiring explicit approval for sensitive actions, and logging every scoped request for review and anomaly detection.