diff --git a/crates/tranquil-oauth-server/src/endpoints/authorize/mod.rs b/crates/tranquil-oauth-server/src/endpoints/authorize/mod.rs
index 4a5e286..b36a2dd 100644
--- a/crates/tranquil-oauth-server/src/endpoints/authorize/mod.rs
+++ b/crates/tranquil-oauth-server/src/endpoints/authorize/mod.rs
@@ -69,25 +69,21 @@ fn json_error(status: StatusCode, error: &str, description: &str) -> Response {
 }
 
 fn is_granular_scope(s: &str) -> bool {
-    s.starts_with("repo:")
-        || s.starts_with("repo?")
-        || s == "repo"
-        || s.starts_with("blob:")
-        || s.starts_with("blob?")
-        || s == "blob"
-        || s.starts_with("rpc:")
-        || s.starts_with("rpc?")
-        || s.starts_with("account:")
-        || s.starts_with("identity:")
+    matches!(
+        tranquil_scopes::parse_scope(s),
+        tranquil_scopes::ParsedScope::Repo(_)
+            | tranquil_scopes::ParsedScope::Blob(_)
+            | tranquil_scopes::ParsedScope::Rpc(_)
+            | tranquil_scopes::ParsedScope::Account(_)
+            | tranquil_scopes::ParsedScope::Identity(_)
+    )
 }
 
 fn is_valid_scope(s: &str) -> bool {
-    s == "atproto"
-        || s == "transition:generic"
-        || s == "transition:chat.bsky"
-        || s == "transition:email"
-        || is_granular_scope(s)
-        || s.starts_with("include:")
+    !matches!(
+        tranquil_scopes::parse_scope(s),
+        tranquil_scopes::ParsedScope::Unknown(_)
+    )
 }
 
 fn extract_device_cookie(headers: &HeaderMap) -> Option<tranquil_types::DeviceId> {
@@ -349,3 +345,21 @@ pub use login::*;
 pub use passkey::*;
 pub use registration::*;
 pub use two_factor::*;
+
+#[cfg(test)]
+mod tests {
+    use super::{is_granular_scope, is_valid_scope};
+
+    #[test]
+    fn consent_accepts_reference_query_scope_forms() {
+        assert!(is_valid_scope("account?attr=email&action=read"));
+        assert!(is_granular_scope("account?attr=email&action=read"));
+        assert!(is_valid_scope(
+            "repo?collection=dev.cocore.compute.provider&action=create&action=update&action=delete"
+        ));
+        assert!(is_valid_scope(
+            "rpc?aud=*&lxm=dev.cocore.devicePair.confirm&lxm=dev.cocore.inference.dispatch"
+        ));
+        assert!(!is_valid_scope("account?attr=email&unknown=value"));
+    }
+}