diff --git a/Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift b/Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift
index 0215474..cecc86f 100644
--- a/Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift
+++ b/Sources/CoreATProtocol/OAuth/ATProtoOAuth.swift
@@ -247,9 +247,12 @@ public final class ATProtoOAuth: Sendable {
             expectedAuthorizationServer: identity.authorizationServer
         )
 
+        var appCredentials = clientConfig.credentials
+        appCredentials.scopes = config.scopes
+
         let makeAuthenticatorConfiguration = {
             Authenticator.Configuration(
-                appCredentials: clientConfig.credentials,
+                appCredentials: appCredentials,
                 loginStorage: loginStorage,
                 tokenHandling: tokenHandling,
                 mode: .manualOnly,
@@ -364,6 +367,8 @@ public final class ATProtoOAuth: Sendable {
         let serverHost = stripScheme(from: issuer)
         let serverConfig = try await ServerMetadata.load(for: serverHost, provider: provider)
         let clientConfig = try await ClientMetadata.load(for: config.clientMetadataURL, provider: provider)
+        var appCredentials = clientConfig.credentials
+        appCredentials.scopes = config.scopes
         let jwtGenerator: DPoPSigner.JWTGenerator = { [self] params in
             try await self.generateJWT(params: params)
         }
@@ -434,18 +439,18 @@ public final class ATProtoOAuth: Sendable {
 
         if config.authProxyBaseURL != nil {
             do {
-                refreshedLogin = try await refreshProvider(login, clientConfig.credentials, proxyResponseProvider)
+                refreshedLogin = try await refreshProvider(login, appCredentials, proxyResponseProvider)
                 usedAuthProxy = true
             } catch {
                 guard shouldRetryWithoutAuthProxy(after: error) else {
                     throw error
                 }
 
-                refreshedLogin = try await refreshProvider(login, clientConfig.credentials, directResponseProvider)
+                refreshedLogin = try await refreshProvider(login, appCredentials, directResponseProvider)
                 usedAuthProxy = false
             }
         } else {
-            refreshedLogin = try await refreshProvider(login, clientConfig.credentials, directResponseProvider)
+            refreshedLogin = try await refreshProvider(login, appCredentials, directResponseProvider)
             usedAuthProxy = false
         }