Best practice for handling OAuth Scope changes and Token Validation

Hi everyone,

I'm building a Monday App using React and Express. I'm using SecureStorage to store the OAuth access_token after the handshake.

I have a concern regarding Scope Management and Token Validation.

Currently, I define my required scopes in an Environment Variable (e.g., MONDAY_SCOPES="boards:read users:read"). In my authentication middleware, I simply check if an access_token exists in the storage. If it exists, I assume the user is authorized.

The Logic:

1. Env: SCOPES="boards:read"

2. User authorizes: I get a token with boards:read and save it to SecureStorage.

3. Later: I update my app features and change Env to SCOPES="boards:read boards:write".

4. The Problem: My middleware still sees the old token in SecureStorage. It returns 200 OK for the auth check, but the API calls fail later because the token lacks the new boards:write permission.

Here is a simplified version of my check:

TypeScript

// Middleware or Auth Check Logic
export async function checkAuth(req, res, next) {
  const secureStorage = new SecureStorage();

  // 1. I retrieve the token
  const accessToken = await secureStorage.get("access_token");

  // 2. I check if it exists
  if (!accessToken) {
    return res.status(401).json({ error: "Re-authorization needed" });
  }

  // THE ISSUE: 
  // I have no way of knowing if this specific 'accessToken' 
  // covers the scopes defined in process.env.MONDAY_SCOPES

  req.mondayToken = accessToken;
  next();
}

My Question: What is the standard way to handle this in Monday Apps?

1. Should I store the granted_scopes string in SecureStorage alongside the access_token and compare them on every request?

2. Or is there an endpoint to "validate" the token and see its scopes before using it?

3. Or should I just let the API call fail with a "Scope Error" and handle the re-auth on the frontend?

I feel like checking against Environment Variables manually is prone to errors. Any advice is welcome!