OAuth all_groups=none still yields all-groups read in /keys/current

[Jude Igumbor]

Hi Zotero developers,

We are implementing a read-only Web API connector and are seeing a reproducible OAuth permission mismatch.

Our authorization request uses exactly:

library_access=1 notes_access=0 write_access=0 all_groups=none

The Zotero consent form correctly shows:

• personal-library read access: ON
• notes: OFF
• write: OFF
• all groups: None
• per-group access: OFF

However, after the key is created, GET /keys/current reports:

access.user.library = true access.user.notes = false access.user.write = false access.groups.all.library = true access.groups.all.write = false

We have reproduced this across multiple fresh OAuth grants. Our application therefore rejects and deletes the key because the resulting grant is broader than requested.

We also audited our request construction and confirmed that all_groups=none is not rewritten or omitted before authorization.

Can you confirm:

1. whether access.groups.all.library = true means the key actually has read access to all current/future group libraries in this case; and
2. whether all_groups=none is expected to prevent that permission?

If this is unexpected, is there a recommended way to obtain a personal-library-only OAuth key?

We can provide a sanitized reproduction report if useful.

Thanks.