[request] idp-like scoped oauth perms to access apps

[alexdevz]

useful to restrict apps to certain people, whether for testing, internal, etc. helpful to link into external applications/software that support oauth but dont allow locking down who can sign in