@@ 674,6 674,24 @@ func (s *Service) OAuthMetadata(c echo.C
 		return err
 	}
 
+	var scopes []string
+	for _, scope := range s.config.Scopes {
+		parts := strings.Split(scope, ":")
+		if len(parts) > 1 {
+			access := parts[1]
+			if access != "RO" && access != "RW" {
+				parts = parts[:1] // Invalid access, reset
+				scope = parts[0]
+			} else {
+				scopes = append(scopes, fmt.Sprintf("%s:%s", parts[0], parts[1]))
+			}
+		}
+		if len(parts) == 1 {
+			scopes = append(scopes, fmt.Sprintf("%s:RO", scope))
+			scopes = append(scopes, fmt.Sprintf("%s:RW", scope))
+		}
+	}
+
 	ret := struct {
 		Issuer        string   `json:"issuer"`
 		AuthEndpoint  string   `json:"authorization_endpoint"`

          
@@ 688,7 706,7 @@ func (s *Service) OAuthMetadata(c echo.C
 		Issuer:        origin,
 		AuthEndpoint:  aURL,
 		TokenEndpoint: tURL,
-		Scopes:        s.config.Scopes,
+		Scopes:        scopes,
 		Responses:     []string{"code"},
 		Grants:        []string{"authorization_code"},
 		Doc:           s.config.DocumentationURL,