title: How do you format an Oauth 2.0 request to include scopes
body: <p>I am writing a PHP web program that needs to access and edit people's info on lichess.org. Their api uses Oauth 2.0 to do this. The problem is no matter what I put in the request it only seems to request public profile information:<a href="https://i.stack.imgur.com/7TKsO.png" rel="nofollow noreferrer">redirect page screenshot</a>. I think I may be formating the url incorrectly but I can't figure out how because the <a href="https://github.com/lichess-org/api/blob/master/example/oauth-authorization-code/index.js" rel="nofollow noreferrer">example code</a> is in JavaScript and I'm less familiar with that. Here is a snippet of the code I'm using to format the string:</p>
  
  <pre><code>$scopes = "email:read%20preference:write";
  $state=generate_string(20);
  $authorize_url = "https://oauth.lichess.org/oauth/authorize";
  
  function getAuthorizationCode() {
          global $authorize_url, $client_id, $callback_uri;
  
          $authorization_redirect_url = $authorize_url . "?response_type=code&amp;client_id=" . $client_id . "&amp;redirect_uri=" . $callback_uri . "&amp;scope=" . $scopes . "&amp;state=".$state;
  
          header("Location: " . $authorization_redirect_url);
  
  }
  </code></pre>
  
  <p>And to generate the state string I'm using this helper function</p>
  
  <pre><code>    function generate_string($strength,$charset='0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ') {
      $Length = strlen($charset);
      $random_string = '';
      for($i = 0; $i &lt; $strength; $i++) {
          $random_character = $charset[mt_rand(0, $Length - 1)];
          $random_string .= $random_character;
      }
  
      return $random_string;
  }
  </code></pre>
  
  <p>And sure enough, when I actually try to request the resource the response is "missing scope". I'm using:</p>
  
  <pre><code>$lichessurl = "https://lichess.org/api/account/email";
  function getAccessToken($authorization_code) {
          global $token_url, $client_id, $client_secret, $callback_uri;
  
          $authorization = base64_encode("$client_id:$client_secret");
          $header = array("Authorization: Basic {$authorization}","Content-Type: application/x-www-form-urlencoded");
          $content = "grant_type=authorization_code&amp;code=$authorization_code&amp;redirect_uri=$callback_uri";
  
          $curl = curl_init();
          curl_setopt_array($curl, array(
                  CURLOPT_URL =&gt; $token_url,
                  CURLOPT_HTTPHEADER =&gt; $header,
                  CURLOPT_SSL_VERIFYPEER =&gt; false,
                  CURLOPT_RETURNTRANSFER =&gt; true,
                  CURLOPT_POST =&gt; true,
                  CURLOPT_POSTFIELDS =&gt; $content
          ));
          $response = curl_exec($curl);
          curl_close($curl);
  
          if ($response === false) {
                  echo "Failed";
                  echo curl_error($curl);
                  echo "Failed";
          } elseif (json_decode($response)-&gt;error) {
                  echo "Error:&lt;br /&gt;";
                  echo $authorization_code;
                  echo $response;
          }
  
          return json_decode($response)-&gt;access_token;
  }
  </code></pre>
  
  <p>in order to do that.</p>