diff --git a/.sqlx/query-b9b57cad3948c2883a05c22ba918232d066fe8cb6f67410a4b4ef99d80386284.json b/.sqlx/query-2f5fb86d249903ea40240658b4f8fd5a8d96120e92d791ff446b441f9222f00f.json
similarity index 59%
rename from .sqlx/query-b9b57cad3948c2883a05c22ba918232d066fe8cb6f67410a4b4ef99d80386284.json
rename to .sqlx/query-2f5fb86d249903ea40240658b4f8fd5a8d96120e92d791ff446b441f9222f00f.json
index 4b21415..04c6889 100644
--- a/.sqlx/query-b9b57cad3948c2883a05c22ba918232d066fe8cb6f67410a4b4ef99d80386284.json
+++ b/.sqlx/query-2f5fb86d249903ea40240658b4f8fd5a8d96120e92d791ff446b441f9222f00f.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "\n        UPDATE oauth_token\n        SET token_id = $2, current_refresh_token = $3, expires_at = $4, updated_at = NOW()\n        WHERE id = $1\n        ",
+  "query": "\n        UPDATE oauth_token\n        SET token_id = $2, current_refresh_token = $3, expires_at = $4, updated_at = NOW(),\n            previous_refresh_token = $5, rotated_at = NOW()\n        WHERE id = $1\n        ",
   "describe": {
     "columns": [],
     "parameters": {
@@ -8,10 +8,11 @@
         "Int4",
         "Text",
         "Text",
-        "Timestamptz"
+        "Timestamptz",
+        "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "b9b57cad3948c2883a05c22ba918232d066fe8cb6f67410a4b4ef99d80386284"
+  "hash": "2f5fb86d249903ea40240658b4f8fd5a8d96120e92d791ff446b441f9222f00f"
 }
diff --git a/.sqlx/query-3d5ab47cdcb0d04b0a0d63c2d5a0cc45889ff4330b500ba7e77eac06ee9606c9.json b/.sqlx/query-3d5ab47cdcb0d04b0a0d63c2d5a0cc45889ff4330b500ba7e77eac06ee9606c9.json
new file mode 100644
index 0000000..6011891
--- /dev/null
+++ b/.sqlx/query-3d5ab47cdcb0d04b0a0d63c2d5a0cc45889ff4330b500ba7e77eac06ee9606c9.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT password_hash, scopes FROM app_passwords WHERE user_id = $1 ORDER BY created_at DESC LIMIT 20",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "password_hash",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 1,
+        "name": "scopes",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Uuid"
+      ]
+    },
+    "nullable": [
+      false,
+      true
+    ]
+  },
+  "hash": "3d5ab47cdcb0d04b0a0d63c2d5a0cc45889ff4330b500ba7e77eac06ee9606c9"
+}
diff --git a/.sqlx/query-44aec49f4ccd1f816c5427af2dc18f5acd55fac92c46ada76be1199d5c7ac459.json b/.sqlx/query-44aec49f4ccd1f816c5427af2dc18f5acd55fac92c46ada76be1199d5c7ac459.json
new file mode 100644
index 0000000..2f04a6a
--- /dev/null
+++ b/.sqlx/query-44aec49f4ccd1f816c5427af2dc18f5acd55fac92c46ada76be1199d5c7ac459.json
@@ -0,0 +1,23 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT access_expires_at FROM session_tokens WHERE did = $1 AND access_jti = $2",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "access_expires_at",
+        "type_info": "Timestamptz"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "44aec49f4ccd1f816c5427af2dc18f5acd55fac92c46ada76be1199d5c7ac459"
+}
diff --git a/.sqlx/query-e2e51654f146a3a336f5a28cbd47addbdd311aeaead530c00c1891c95bede0b8.json b/.sqlx/query-6b0245cefaec65a48c51239ed099e45c5347224c81f7d01d7af5bd7664d16883.json
similarity index 54%
rename from .sqlx/query-e2e51654f146a3a336f5a28cbd47addbdd311aeaead530c00c1891c95bede0b8.json
rename to .sqlx/query-6b0245cefaec65a48c51239ed099e45c5347224c81f7d01d7af5bd7664d16883.json
index 8c5b220..f9b3500 100644
--- a/.sqlx/query-e2e51654f146a3a336f5a28cbd47addbdd311aeaead530c00c1891c95bede0b8.json
+++ b/.sqlx/query-6b0245cefaec65a48c51239ed099e45c5347224c81f7d01d7af5bd7664d16883.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT st.id, st.did, k.key_bytes, k.encryption_version\n           FROM session_tokens st\n           JOIN users u ON st.did = u.did\n           JOIN user_keys k ON u.id = k.user_id\n           WHERE st.refresh_jti = $1 AND st.refresh_expires_at > NOW()\n           FOR UPDATE OF st",
+  "query": "SELECT st.id, st.did, st.scope, k.key_bytes, k.encryption_version\n           FROM session_tokens st\n           JOIN users u ON st.did = u.did\n           JOIN user_keys k ON u.id = k.user_id\n           WHERE st.refresh_jti = $1 AND st.refresh_expires_at > NOW()\n           FOR UPDATE OF st",
   "describe": {
     "columns": [
       {
@@ -15,11 +15,16 @@
       },
       {
         "ordinal": 2,
+        "name": "scope",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
         "name": "key_bytes",
         "type_info": "Bytea"
       },
       {
-        "ordinal": 3,
+        "ordinal": 4,
         "name": "encryption_version",
         "type_info": "Int4"
       }
@@ -32,9 +37,10 @@
     "nullable": [
       false,
       false,
+      true,
       false,
       true
     ]
   },
-  "hash": "e2e51654f146a3a336f5a28cbd47addbdd311aeaead530c00c1891c95bede0b8"
+  "hash": "6b0245cefaec65a48c51239ed099e45c5347224c81f7d01d7af5bd7664d16883"
 }
diff --git a/.sqlx/query-301a8e352f7ebae1748ce1dc05860cef459764ca3c38b97693f00d67fd6bdd7e.json b/.sqlx/query-815bef7ea956cf53f10728a0edfd6064784e994e94c64e482306f803b3746f24.json
similarity index 69%
rename from .sqlx/query-301a8e352f7ebae1748ce1dc05860cef459764ca3c38b97693f00d67fd6bdd7e.json
rename to .sqlx/query-815bef7ea956cf53f10728a0edfd6064784e994e94c64e482306f803b3746f24.json
index 3ef7a34..7d12be6 100644
--- a/.sqlx/query-301a8e352f7ebae1748ce1dc05860cef459764ca3c38b97693f00d67fd6bdd7e.json
+++ b/.sqlx/query-815bef7ea956cf53f10728a0edfd6064784e994e94c64e482306f803b3746f24.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO session_tokens (did, access_jti, refresh_jti, access_expires_at, refresh_expires_at, legacy_login, mfa_verified) VALUES ($1, $2, $3, $4, $5, $6, $7)",
+  "query": "INSERT INTO session_tokens (did, access_jti, refresh_jti, access_expires_at, refresh_expires_at, legacy_login, mfa_verified, scope) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
   "describe": {
     "columns": [],
     "parameters": {
@@ -11,10 +11,11 @@
         "Timestamptz",
         "Timestamptz",
         "Bool",
-        "Bool"
+        "Bool",
+        "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "301a8e352f7ebae1748ce1dc05860cef459764ca3c38b97693f00d67fd6bdd7e"
+  "hash": "815bef7ea956cf53f10728a0edfd6064784e994e94c64e482306f803b3746f24"
 }
diff --git a/.sqlx/query-15a3cb31c36192c76c0cfa881043d70a1cc2c212fa382f8d9efc3c35ea4e66c1.json b/.sqlx/query-8d634d6c3306424ed9239f078a4892245f4b73049037ea8f3cf23fc377b57a40.json
similarity index 60%
rename from .sqlx/query-15a3cb31c36192c76c0cfa881043d70a1cc2c212fa382f8d9efc3c35ea4e66c1.json
rename to .sqlx/query-8d634d6c3306424ed9239f078a4892245f4b73049037ea8f3cf23fc377b57a40.json
index df3aa67..d8be7b1 100644
--- a/.sqlx/query-15a3cb31c36192c76c0cfa881043d70a1cc2c212fa382f8d9efc3c35ea4e66c1.json
+++ b/.sqlx/query-8d634d6c3306424ed9239f078a4892245f4b73049037ea8f3cf23fc377b57a40.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO app_passwords (user_id, name, password_hash, created_at, privileged) VALUES ($1, $2, $3, $4, $5)",
+  "query": "INSERT INTO app_passwords (user_id, name, password_hash, created_at, privileged, scopes) VALUES ($1, $2, $3, $4, $5, $6)",
   "describe": {
     "columns": [],
     "parameters": {
@@ -9,10 +9,11 @@
         "Text",
         "Text",
         "Timestamptz",
-        "Bool"
+        "Bool",
+        "Text"
       ]
     },
     "nullable": []
   },
-  "hash": "15a3cb31c36192c76c0cfa881043d70a1cc2c212fa382f8d9efc3c35ea4e66c1"
+  "hash": "8d634d6c3306424ed9239f078a4892245f4b73049037ea8f3cf23fc377b57a40"
 }
diff --git a/.sqlx/query-d69f93ad69fe627d6939dced19b752efc49f6a807a0ae21ebf682433a0d63dd7.json b/.sqlx/query-d69f93ad69fe627d6939dced19b752efc49f6a807a0ae21ebf682433a0d63dd7.json
deleted file mode 100644
index 004e5c0..0000000
--- a/.sqlx/query-d69f93ad69fe627d6939dced19b752efc49f6a807a0ae21ebf682433a0d63dd7.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT 1 as one FROM session_tokens WHERE did = $1 AND access_jti = $2 AND access_expires_at > NOW()",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "one",
-        "type_info": "Int4"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Text",
-        "Text"
-      ]
-    },
-    "nullable": [
-      null
-    ]
-  },
-  "hash": "d69f93ad69fe627d6939dced19b752efc49f6a807a0ae21ebf682433a0d63dd7"
-}
diff --git a/.sqlx/query-dcaedeec794a63ce8abb9b580461c193ad58fee110d57249f98355b40b757a37.json b/.sqlx/query-dcaedeec794a63ce8abb9b580461c193ad58fee110d57249f98355b40b757a37.json
deleted file mode 100644
index 81649b0..0000000
--- a/.sqlx/query-dcaedeec794a63ce8abb9b580461c193ad58fee110d57249f98355b40b757a37.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "SELECT password_hash FROM app_passwords WHERE user_id = $1 ORDER BY created_at DESC LIMIT 20",
-  "describe": {
-    "columns": [
-      {
-        "ordinal": 0,
-        "name": "password_hash",
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Left": [
-        "Uuid"
-      ]
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "dcaedeec794a63ce8abb9b580461c193ad58fee110d57249f98355b40b757a37"
-}
diff --git a/.sqlx/query-cec87a805457bcac6db8be601861b351a9332c649433894547176f6e4d672d01.json b/.sqlx/query-f47f2236dcc27bc203b0cd13cc022611492f0f82c572c5a536663e8d252cfafb.json
similarity index 60%
rename from .sqlx/query-cec87a805457bcac6db8be601861b351a9332c649433894547176f6e4d672d01.json
rename to .sqlx/query-f47f2236dcc27bc203b0cd13cc022611492f0f82c572c5a536663e8d252cfafb.json
index 90c7326..93f1ba5 100644
--- a/.sqlx/query-cec87a805457bcac6db8be601861b351a9332c649433894547176f6e4d672d01.json
+++ b/.sqlx/query-f47f2236dcc27bc203b0cd13cc022611492f0f82c572c5a536663e8d252cfafb.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT name, created_at, privileged FROM app_passwords WHERE user_id = $1 ORDER BY created_at DESC",
+  "query": "SELECT name, created_at, privileged, scopes FROM app_passwords WHERE user_id = $1 ORDER BY created_at DESC",
   "describe": {
     "columns": [
       {
@@ -17,6 +17,11 @@
         "ordinal": 2,
         "name": "privileged",
         "type_info": "Bool"
+      },
+      {
+        "ordinal": 3,
+        "name": "scopes",
+        "type_info": "Text"
       }
     ],
     "parameters": {
@@ -27,8 +32,9 @@
     "nullable": [
       false,
       false,
-      false
+      false,
+      true
     ]
   },
-  "hash": "cec87a805457bcac6db8be601861b351a9332c649433894547176f6e4d672d01"
+  "hash": "f47f2236dcc27bc203b0cd13cc022611492f0f82c572c5a536663e8d252cfafb"
 }
diff --git a/.sqlx/query-fd291f783059a00c2ac29920bcb5f12a0553148d8a216eb21dd0e63d5a4b1913.json b/.sqlx/query-fd291f783059a00c2ac29920bcb5f12a0553148d8a216eb21dd0e63d5a4b1913.json
new file mode 100644
index 0000000..c1da7a4
--- /dev/null
+++ b/.sqlx/query-fd291f783059a00c2ac29920bcb5f12a0553148d8a216eb21dd0e63d5a4b1913.json
@@ -0,0 +1,101 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "\n        SELECT id, did, token_id, created_at, updated_at, expires_at, client_id, client_auth,\n               device_id, parameters, details, code, current_refresh_token, scope\n        FROM oauth_token\n        WHERE previous_refresh_token = $1 AND rotated_at > $2\n        ",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "id",
+        "type_info": "Int4"
+      },
+      {
+        "ordinal": 1,
+        "name": "did",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 2,
+        "name": "token_id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 3,
+        "name": "created_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 4,
+        "name": "updated_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 5,
+        "name": "expires_at",
+        "type_info": "Timestamptz"
+      },
+      {
+        "ordinal": 6,
+        "name": "client_id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 7,
+        "name": "client_auth",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 8,
+        "name": "device_id",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 9,
+        "name": "parameters",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 10,
+        "name": "details",
+        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 11,
+        "name": "code",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 12,
+        "name": "current_refresh_token",
+        "type_info": "Text"
+      },
+      {
+        "ordinal": 13,
+        "name": "scope",
+        "type_info": "Text"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text",
+        "Timestamptz"
+      ]
+    },
+    "nullable": [
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      false,
+      true,
+      false,
+      true,
+      true,
+      true,
+      true
+    ]
+  },
+  "hash": "fd291f783059a00c2ac29920bcb5f12a0553148d8a216eb21dd0e63d5a4b1913"
+}
diff --git a/README.md b/README.md
index 413aa0b..a48f832 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ Another excellent PDS is [Cocoon](https://github.com/haileyok/cocoon), written i
 
 This software isn't an afterthought by a company with limited resources.
 
-It is a superset of the reference PDS, including: passkeys and 2FA (WebAuthn/FIDO2, TOTP, backup codes, trusted devices), did:web support (PDS-hosted subdomains or bring-your-own), multi-channel communication (email, discord, telegram, signal) for verification and alerts, granular OAuth scopes with a consent UI showing human-readable descriptions, and a built-in web UI for account management, OAuth consent, repo browsing, and admin.
+It is a superset of the reference PDS, including: passkeys and 2FA (WebAuthn/FIDO2, TOTP, backup codes, trusted devices), did:web support (PDS-hosted subdomains or bring-your-own), multi-channel communication (email, discord, telegram, signal) for verification and alerts, granular OAuth scopes with a consent UI showing human-readable descriptions, app passwords with granular permissions (read-only, post-only, or custom scopes), and a built-in web UI for account management, OAuth consent, repo browsing, and admin.
 
 The PDS itself is a single small binary with no node/npm runtime. It does require postgres, valkey, and s3-compatible storage, which makes setup heavier than the reference PDS's sqlite. The tradeoff is that these are battle-tested pieces of infra that we already know how to scale, back up, and monitor. 
 
@@ -66,4 +66,5 @@ This project is very grateful to [@nel.pet](https://bsky.app/profile/did:plc:h5w
 
 ## License
 
-TBD
+AGPL-3.0-or-later. Documentation is CC BY-SA 4.0. See [LICENSE](LICENSE) for details.
+
diff --git a/TODO.md b/TODO.md
index 79d24ee..d51837c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -2,13 +2,6 @@
 
 ## Active development
 
-### Frontend
-So like... make the thing unique, make it cool.
-
-- [ ] Frontpage that explains what this thing is
-- [ ] Unique "brand" style both unauthed and authed
-- [ ] Better documentation on how to sub out the entire frontend for whatever the users want
-
 ### Delegated accounts
 Accounts controlled by other accounts rather than having their own password. When logging in as a delegated account, OAuth asks you to authenticate with a linked controller account. Uses OAuth scopes as the permission model.
 
@@ -90,3 +83,5 @@ Web UI: OAuth login, registration, email verification, password reset, multi-acc
 Auth: ES256K + HS256 dual support, JTI-only token storage, refresh token family tracking, encrypted signing keys (AES-256-GCM), DPoP replay protection, constant-time comparisons.
 
 Passkeys and 2FA: WebAuthn/FIDO2 passkey registration and authentication, TOTP with QR setup, backup codes (hashed, one-time use), passkey-only account creation, trusted devices (remember this browser), re-auth for sensitive actions, rate-limited 2FA attempts, settings UI for managing all auth methods.
+
+App password scopes: Granular permissions for app passwords using the same scope system as OAuth. Preset buttons for common use cases (full access, read-only, post-only), scope stored in session and preserved across token refresh, explicit RPC/repo/blob scope enforcement for restricted passwords.
diff --git a/frontend/src/lib/api.ts b/frontend/src/lib/api.ts
index d24cd42..3763cf5 100644
--- a/frontend/src/lib/api.ts
+++ b/frontend/src/lib/api.ts
@@ -93,6 +93,7 @@ export interface Session {
 export interface AppPassword {
   name: string;
   createdAt: string;
+  scopes?: string;
 }
 
 export interface InviteCode {
@@ -226,11 +227,14 @@ export const api = {
   async createAppPassword(
     token: string,
     name: string,
-  ): Promise<{ name: string; password: string; createdAt: string }> {
+    scopes?: string,
+  ): Promise<
+    { name: string; password: string; createdAt: string; scopes?: string }
+  > {
     return xrpc("com.atproto.server.createAppPassword", {
       method: "POST",
       token,
-      body: { name },
+      body: { name, scopes },
     });
   },
 
diff --git a/frontend/src/locales/en.json b/frontend/src/locales/en.json
index 8bfd8e1..c057f30 100644
--- a/frontend/src/locales/en.json
+++ b/frontend/src/locales/en.json
@@ -266,7 +266,12 @@
     "revokeConfirm": "Revoke app password \"{name}\"? Apps using this password will no longer be able to access your account.",
     "saveWarningTitle": "Important: Save this app password!",
     "saveWarningMessage": "This password is required to sign into apps that don't support passkeys or OAuth. You will only see it once.",
-    "acknowledgeLabel": "I have saved my app password in a secure location"
+    "acknowledgeLabel": "I have saved my app password in a secure location",
+    "permissions": "Permissions",
+    "scopeFull": "Full Access",
+    "scopeReadOnly": "Read Only",
+    "scopePostOnly": "Post Only",
+    "scopeCustom": "Custom"
   },
   "sessions": {
     "title": "Active Sessions",
diff --git a/frontend/src/locales/fi.json b/frontend/src/locales/fi.json
index d744284..aae5281 100644
--- a/frontend/src/locales/fi.json
+++ b/frontend/src/locales/fi.json
@@ -266,7 +266,12 @@
     "revokeConfirm": "Peruuta sovelluksen salasana \"{name}\"? Sovellukset, jotka käyttävät tätä salasanaa, eivät enää pääse tilillesi.",
     "saveWarningTitle": "Tärkeää: Tallenna tämä sovelluksen salasana!",
     "saveWarningMessage": "Tämä salasana tarvitaan kirjautumiseen sovelluksiin, jotka eivät tue pääsyavaimia tai OAuthia. Näet sen vain kerran.",
-    "acknowledgeLabel": "Olen tallentanut sovelluksen salasanani turvalliseen paikkaan"
+    "acknowledgeLabel": "Olen tallentanut sovelluksen salasanani turvalliseen paikkaan",
+    "permissions": "Käyttöoikeudet",
+    "scopeFull": "Täydet oikeudet",
+    "scopeReadOnly": "Vain luku",
+    "scopePostOnly": "Vain julkaisut",
+    "scopeCustom": "Mukautettu"
   },
   "sessions": {
     "title": "Aktiiviset istunnot",
diff --git a/frontend/src/locales/ja.json b/frontend/src/locales/ja.json
index 57820a0..cffe171 100644
--- a/frontend/src/locales/ja.json
+++ b/frontend/src/locales/ja.json
@@ -266,7 +266,12 @@
     "revokeConfirm": "アプリパスワード「{name}」を取り消しますか？このパスワードを使用しているアプリはアカウントにアクセスできなくなります。",
     "saveWarningTitle": "重要: このアプリパスワードを保存してください！",
     "saveWarningMessage": "このパスワードはパスキーや OAuth をサポートしていないアプリにサインインするために必要です。一度しか表示されません。",
-    "acknowledgeLabel": "アプリパスワードを安全な場所に保存しました"
+    "acknowledgeLabel": "アプリパスワードを安全な場所に保存しました",
+    "permissions": "権限",
+    "scopeFull": "フルアクセス",
+    "scopeReadOnly": "読み取り専用",
+    "scopePostOnly": "投稿のみ",
+    "scopeCustom": "カスタム"
   },
   "sessions": {
     "title": "アクティブセッション",
diff --git a/frontend/src/locales/ko.json b/frontend/src/locales/ko.json
index 953a76a..a505f3a 100644
--- a/frontend/src/locales/ko.json
+++ b/frontend/src/locales/ko.json
@@ -266,7 +266,12 @@
     "revokeConfirm": "앱 비밀번호 \"{name}\"을(를) 취소하시겠습니까? 이 비밀번호를 사용하는 앱은 더 이상 계정에 액세스할 수 없습니다.",
     "saveWarningTitle": "중요: 이 앱 비밀번호를 저장하세요!",
     "saveWarningMessage": "이 비밀번호는 패스키 또는 OAuth를 지원하지 않는 앱에 로그인하는 데 필요합니다. 한 번만 볼 수 있습니다.",
-    "acknowledgeLabel": "앱 비밀번호를 안전한 곳에 저장했습니다"
+    "acknowledgeLabel": "앱 비밀번호를 안전한 곳에 저장했습니다",
+    "permissions": "권한",
+    "scopeFull": "전체 권한",
+    "scopeReadOnly": "읽기 전용",
+    "scopePostOnly": "게시만 가능",
+    "scopeCustom": "사용자 지정"
   },
   "sessions": {
     "title": "활성 세션",
diff --git a/frontend/src/locales/sv.json b/frontend/src/locales/sv.json
index 1171603..8a69fac 100644
--- a/frontend/src/locales/sv.json
+++ b/frontend/src/locales/sv.json
@@ -266,7 +266,12 @@
     "revokeConfirm": "Återkalla applösenord \"{name}\"? Appar som använder detta lösenord kommer inte längre att kunna komma åt ditt konto.",
     "saveWarningTitle": "Viktigt: Spara detta applösenord!",
     "saveWarningMessage": "Detta lösenord krävs för att logga in i appar som inte stöder passkeys eller OAuth. Du ser det bara en gång.",
-    "acknowledgeLabel": "Jag har sparat mitt applösenord på en säker plats"
+    "acknowledgeLabel": "Jag har sparat mitt applösenord på en säker plats",
+    "permissions": "Behörigheter",
+    "scopeFull": "Full åtkomst",
+    "scopeReadOnly": "Endast läsning",
+    "scopePostOnly": "Endast publicering",
+    "scopeCustom": "Anpassad"
   },
   "sessions": {
     "title": "Aktiva sessioner",
diff --git a/frontend/src/locales/zh.json b/frontend/src/locales/zh.json
index 431656c..f84e1f4 100644
--- a/frontend/src/locales/zh.json
+++ b/frontend/src/locales/zh.json
@@ -266,7 +266,12 @@
     "revokeConfirm": "撤销「{name}」的密码？使用此密码的应用将无法再访问您的账户。",
     "saveWarningTitle": "重要：请保存此应用专用密码！",
     "saveWarningMessage": "此密码用于登录不支持通行密钥或 OAuth 的应用。您只能看到一次。",
-    "acknowledgeLabel": "我已将应用专用密码保存在安全的地方"
+    "acknowledgeLabel": "我已将应用专用密码保存在安全的地方",
+    "permissions": "权限",
+    "scopeFull": "完全访问",
+    "scopeReadOnly": "只读",
+    "scopePostOnly": "仅发帖",
+    "scopeCustom": "自定义"
   },
   "sessions": {
     "title": "登录会话",
diff --git a/frontend/src/routes/AppPasswords.svelte b/frontend/src/routes/AppPasswords.svelte
index 9f13e4e..798755f 100644
--- a/frontend/src/routes/AppPasswords.svelte
+++ b/frontend/src/routes/AppPasswords.svelte
@@ -9,11 +9,25 @@
   let loading = $state(true)
   let error = $state<string | null>(null)
   let newPasswordName = $state('')
+  let selectedScope = $state<string | null>(null)
   let creating = $state(false)
   let createdPassword = $state<{ name: string; password: string } | null>(null)
   let passwordCopied = $state(false)
   let passwordAcknowledged = $state(false)
   let revoking = $state<string | null>(null)
+
+  const SCOPE_PRESETS = [
+    { id: 'full', label: 'appPasswords.scopeFull', scopes: null },
+    { id: 'readonly', label: 'appPasswords.scopeReadOnly', scopes: 'rpc:app.bsky.*?aud=* rpc:chat.bsky.*?aud=* account:status?action=read' },
+    { id: 'post', label: 'appPasswords.scopePostOnly', scopes: 'repo:app.bsky.feed.post?action=create blob:*/*' },
+  ]
+
+  function getScopeLabel(scopes: string | null | undefined): string {
+    if (!scopes) return $_('appPasswords.scopeFull')
+    const preset = SCOPE_PRESETS.find(p => p.scopes === scopes)
+    if (preset) return $_(preset.label)
+    return $_('appPasswords.scopeCustom')
+  }
   $effect(() => {
     if (!auth.loading && !auth.session) {
       navigate('/login')
@@ -43,9 +57,11 @@
     creating = true
     error = null
     try {
-      const result = await api.createAppPassword(auth.session.accessJwt, newPasswordName.trim())
+      const scopeValue = selectedScope === null ? undefined : selectedScope
+      const result = await api.createAppPassword(auth.session.accessJwt, newPasswordName.trim(), scopeValue ?? undefined)
       createdPassword = { name: result.name, password: result.password }
       newPasswordName = ''
+      selectedScope = null
       await loadPasswords()
     } catch (e) {
       error = e instanceof ApiError ? e.message : 'Failed to create app password'
@@ -122,6 +138,22 @@
         disabled={creating}
         required
       />
+      <div class="scope-selector" role="group" aria-label={$_('appPasswords.permissions')}>
+        <span class="scope-label">{$_('appPasswords.permissions')}:</span>
+        <div class="scope-buttons">
+          {#each SCOPE_PRESETS as preset}
+            <button
+              type="button"
+              class="scope-btn"
+              class:selected={selectedScope === preset.scopes}
+              onclick={() => selectedScope = preset.scopes}
+              disabled={creating}
+            >
+              {$_(preset.label)}
+            </button>
+          {/each}
+        </div>
+      </div>
       <button type="submit" disabled={creating || !newPasswordName.trim()}>
         {creating ? $_('appPasswords.creating') : $_('common.create')}
       </button>
@@ -139,7 +171,10 @@
           <li>
             <div class="password-info">
               <span class="name">{pw.name}</span>
-              <span class="date">{$_('common.created')} {formatDate(pw.createdAt)}</span>
+              <span class="meta">
+                <span class="scope-badge" class:full={!pw.scopes}>{getScopeLabel(pw.scopes)}</span>
+                <span class="date">{$_('common.created')} {formatDate(pw.createdAt)}</span>
+              </span>
             </div>
             <button
               class="revoke"
@@ -279,11 +314,60 @@
 
   .create-section form {
     display: flex;
+    flex-direction: column;
+    gap: var(--space-4);
+  }
+
+  .create-section form > input {
+    flex: 1;
+  }
+
+  .create-section form > button {
+    align-self: flex-start;
+  }
+
+  .scope-selector {
+    display: flex;
+    flex-direction: column;
     gap: var(--space-2);
   }
 
-  .create-section input {
-    flex: 1;
+  .scope-label {
+    font-size: var(--text-sm);
+    color: var(--text-secondary);
+  }
+
+  .scope-buttons {
+    display: flex;
+    flex-wrap: wrap;
+    gap: var(--space-2);
+  }
+
+  .scope-btn {
+    padding: var(--space-2) var(--space-4);
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-md);
+    color: var(--text-primary);
+    cursor: pointer;
+    font-size: var(--text-sm);
+    transition: all 0.15s ease;
+  }
+
+  .scope-btn:hover:not(:disabled) {
+    background: var(--bg-hover);
+    border-color: var(--accent);
+  }
+
+  .scope-btn.selected {
+    background: var(--accent);
+    border-color: var(--accent);
+    color: var(--text-inverse);
+  }
+
+  .scope-btn:disabled {
+    opacity: 0.6;
+    cursor: not-allowed;
   }
 
   .password-list {
@@ -313,6 +397,27 @@
     font-weight: var(--font-medium);
   }
 
+  .meta {
+    display: flex;
+    align-items: center;
+    gap: var(--space-3);
+  }
+
+  .scope-badge {
+    font-size: var(--text-xs);
+    padding: var(--space-1) var(--space-2);
+    background: var(--bg-secondary);
+    border: 1px solid var(--border-color);
+    border-radius: var(--radius-sm);
+    color: var(--text-secondary);
+  }
+
+  .scope-badge.full {
+    background: var(--success-bg);
+    border-color: var(--success-border);
+    color: var(--success-text);
+  }
+
   .date {
     font-size: var(--text-sm);
     color: var(--text-secondary);
diff --git a/frontend/src/routes/Home.svelte b/frontend/src/routes/Home.svelte
index b0cd6ab..68e1acf 100644
--- a/frontend/src/routes/Home.svelte
+++ b/frontend/src/routes/Home.svelte
@@ -173,6 +173,11 @@
         <h3>You decide what apps can do</h3>
         <p>When an app asks for access, you'll see exactly what it wants in plain language. Grant what makes sense, deny what doesn't.</p>
       </div>
+
+      <div class="feature">
+        <h3>App passwords with guardrails</h3>
+        <p>Create app passwords that can only do specific things: read-only for feed readers, post-only for bots. Full control over what each password can access.</p>
+      </div>
     </div>
 
     <h2>Everything in one place</h2>
diff --git a/migrations/20251234_app_password_scopes.sql b/migrations/20251234_app_password_scopes.sql
new file mode 100644
index 0000000..7491a88
--- /dev/null
+++ b/migrations/20251234_app_password_scopes.sql
@@ -0,0 +1 @@
+ALTER TABLE app_passwords ADD COLUMN scopes TEXT;
diff --git a/migrations/20251235_session_token_scope.sql b/migrations/20251235_session_token_scope.sql
new file mode 100644
index 0000000..23ce400
--- /dev/null
+++ b/migrations/20251235_session_token_scope.sql
@@ -0,0 +1 @@
+ALTER TABLE session_tokens ADD COLUMN scope TEXT;
diff --git a/migrations/20251236_oauth_refresh_grace_period.sql b/migrations/20251236_oauth_refresh_grace_period.sql
new file mode 100644
index 0000000..8806508
--- /dev/null
+++ b/migrations/20251236_oauth_refresh_grace_period.sql
@@ -0,0 +1,2 @@
+ALTER TABLE oauth_token ADD COLUMN previous_refresh_token TEXT;
+ALTER TABLE oauth_token ADD COLUMN rotated_at TIMESTAMPTZ;
diff --git a/src/api/proxy.rs b/src/api/proxy.rs
index 243ccba..8b5e32c 100644
--- a/src/api/proxy.rs
+++ b/src/api/proxy.rs
@@ -94,6 +94,16 @@ pub async fn proxy_handler(
             }
             Err(e) => {
                 warn!("Token validation failed: {:?}", e);
+                if matches!(e, crate::auth::TokenValidationError::TokenExpired) {
+                    return (
+                        StatusCode::BAD_REQUEST,
+                        Json(json!({
+                            "error": "ExpiredToken",
+                            "message": "Token has expired"
+                        })),
+                    )
+                        .into_response();
+                }
             }
         }
     }
diff --git a/src/api/repo/record/batch.rs b/src/api/repo/record/batch.rs
index 3810062..f0c43b8 100644
--- a/src/api/repo/record/batch.rs
+++ b/src/api/repo/record/batch.rs
@@ -19,7 +19,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::str::FromStr;
 use std::sync::Arc;
-use tracing::error;
+use tracing::{error, info};
 
 const MAX_BATCH_WRITES: usize = 200;
 
@@ -79,6 +79,11 @@ pub async fn apply_writes(
     headers: axum::http::HeaderMap,
     Json(input): Json<ApplyWritesInput>,
 ) -> Response {
+    info!(
+        "apply_writes called: repo={}, writes={}",
+        input.repo,
+        input.writes.len()
+    );
     let token = match crate::auth::extract_bearer_token_from_header(
         headers.get("Authorization").and_then(|h| h.to_str().ok()),
     ) {
@@ -147,7 +152,11 @@ pub async fn apply_writes(
             .into_response();
     }
 
-    if is_oauth {
+    let has_custom_scope = scope
+        .as_ref()
+        .map(|s| s != "com.atproto.access")
+        .unwrap_or(false);
+    if is_oauth || has_custom_scope {
         use std::collections::HashSet;
         let create_collections: HashSet<&str> = input
             .writes
diff --git a/src/api/repo/record/utils.rs b/src/api/repo/record/utils.rs
index ab07234..23cb1d4 100644
--- a/src/api/repo/record/utils.rs
+++ b/src/api/repo/record/utils.rs
@@ -16,10 +16,10 @@ pub fn create_signed_commit(
     prev: Option<Cid>,
     signing_key: &SigningKey,
 ) -> Result<(Vec<u8>, Bytes), String> {
-    let did = jacquard::types::string::Did::new(did)
-        .map_err(|e| format!("Invalid DID: {:?}", e))?;
-    let rev = jacquard::types::string::Tid::from_str(rev)
-        .map_err(|e| format!("Invalid TID: {:?}", e))?;
+    let did =
+        jacquard::types::string::Did::new(did).map_err(|e| format!("Invalid DID: {:?}", e))?;
+    let rev =
+        jacquard::types::string::Tid::from_str(rev).map_err(|e| format!("Invalid TID: {:?}", e))?;
     let unsigned = Commit::new_unsigned(did, data, rev, prev);
     let signed = unsigned
         .sign(signing_key)
diff --git a/src/api/server/app_password.rs b/src/api/server/app_password.rs
index 6728c31..a48aeaa 100644
--- a/src/api/server/app_password.rs
+++ b/src/api/server/app_password.rs
@@ -18,6 +18,8 @@ pub struct AppPassword {
     pub name: String,
     pub created_at: String,
     pub privileged: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub scopes: Option<String>,
 }
 
 #[derive(Serialize)]
@@ -34,7 +36,7 @@ pub async fn list_app_passwords(
         Err(e) => return ApiError::from(e).into_response(),
     };
     match sqlx::query!(
-        "SELECT name, created_at, privileged FROM app_passwords WHERE user_id = $1 ORDER BY created_at DESC",
+        "SELECT name, created_at, privileged, scopes FROM app_passwords WHERE user_id = $1 ORDER BY created_at DESC",
         user_id
     )
     .fetch_all(&state.db)
@@ -47,6 +49,7 @@ pub async fn list_app_passwords(
                     name: row.name.clone(),
                     created_at: row.created_at.to_rfc3339(),
                     privileged: row.privileged,
+                    scopes: row.scopes.clone(),
                 })
                 .collect();
             Json(ListAppPasswordsOutput { passwords }).into_response()
@@ -62,6 +65,7 @@ pub async fn list_app_passwords(
 pub struct CreateAppPasswordInput {
     pub name: String,
     pub privileged: Option<bool>,
+    pub scopes: Option<String>,
 }
 
 #[derive(Serialize)]
@@ -71,6 +75,8 @@ pub struct CreateAppPasswordOutput {
     pub password: String,
     pub created_at: String,
     pub privileged: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub scopes: Option<String>,
 }
 
 pub async fn create_app_password(
@@ -131,14 +137,16 @@ pub async fn create_app_password(
         }
     };
     let privileged = input.privileged.unwrap_or(false);
+    let scopes = input.scopes.clone();
     let created_at = chrono::Utc::now();
     match sqlx::query!(
-        "INSERT INTO app_passwords (user_id, name, password_hash, created_at, privileged) VALUES ($1, $2, $3, $4, $5)",
+        "INSERT INTO app_passwords (user_id, name, password_hash, created_at, privileged, scopes) VALUES ($1, $2, $3, $4, $5, $6)",
         user_id,
         name,
         password_hash,
         created_at,
-        privileged
+        privileged,
+        scopes
     )
     .execute(&state.db)
     .await
@@ -148,6 +156,7 @@ pub async fn create_app_password(
             password,
             created_at: created_at.to_rfc3339(),
             privileged,
+            scopes,
         })
         .into_response(),
         Err(e) => {
diff --git a/src/api/server/session.rs b/src/api/server/session.rs
index 638feeb..e1c1ec9 100644
--- a/src/api/server/session.rs
+++ b/src/api/server/session.rs
@@ -125,24 +125,28 @@ pub async fn create_session(
             return ApiError::InternalError.into_response();
         }
     };
-    let password_valid = if row
+    let (password_valid, app_password_scopes) = if row
         .password_hash
         .as_ref()
         .map(|h| verify(&input.password, h).unwrap_or(false))
         .unwrap_or(false)
     {
-        true
+        (true, None)
     } else {
         let app_passwords = sqlx::query!(
-            "SELECT password_hash FROM app_passwords WHERE user_id = $1 ORDER BY created_at DESC LIMIT 20",
+            "SELECT password_hash, scopes FROM app_passwords WHERE user_id = $1 ORDER BY created_at DESC LIMIT 20",
             row.id
         )
         .fetch_all(&state.db)
         .await
         .unwrap_or_default();
-        app_passwords
+        let matched = app_passwords
             .iter()
-            .any(|app| verify(&input.password, &app.password_hash).unwrap_or(false))
+            .find(|app| verify(&input.password, &app.password_hash).unwrap_or(false));
+        match matched {
+            Some(app) => (true, app.scopes.clone()),
+            None => (false, None),
+        }
     };
     if !password_valid {
         warn!("Password verification failed for login attempt");
@@ -177,7 +181,11 @@ pub async fn create_session(
         )
             .into_response();
     }
-    let access_meta = match crate::auth::create_access_token_with_metadata(&row.did, &key_bytes) {
+    let access_meta = match crate::auth::create_access_token_with_scope_metadata(
+        &row.did,
+        &key_bytes,
+        app_password_scopes.as_deref(),
+    ) {
         Ok(m) => m,
         Err(e) => {
             error!("Failed to create access token: {:?}", e);
@@ -192,14 +200,15 @@ pub async fn create_session(
         }
     };
     if let Err(e) = sqlx::query!(
-        "INSERT INTO session_tokens (did, access_jti, refresh_jti, access_expires_at, refresh_expires_at, legacy_login, mfa_verified) VALUES ($1, $2, $3, $4, $5, $6, $7)",
+        "INSERT INTO session_tokens (did, access_jti, refresh_jti, access_expires_at, refresh_expires_at, legacy_login, mfa_verified, scope) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
         row.did,
         access_meta.jti,
         refresh_meta.jti,
         access_meta.expires_at,
         refresh_meta.expires_at,
         is_legacy_login,
-        false
+        false,
+        app_password_scopes
     )
     .execute(&state.db)
     .await
@@ -388,7 +397,7 @@ pub async fn refresh_session(
         .into_response();
     }
     let session_row = match sqlx::query!(
-        r#"SELECT st.id, st.did, k.key_bytes, k.encryption_version
+        r#"SELECT st.id, st.did, st.scope, k.key_bytes, k.encryption_version
            FROM session_tokens st
            JOIN users u ON st.did = u.did
            JOIN user_keys k ON u.id = k.user_id
@@ -420,14 +429,17 @@ pub async fn refresh_session(
     if crate::auth::verify_refresh_token(&refresh_token, &key_bytes).is_err() {
         return ApiError::AuthenticationFailedMsg("Invalid refresh token".into()).into_response();
     }
-    let new_access_meta =
-        match crate::auth::create_access_token_with_metadata(&session_row.did, &key_bytes) {
-            Ok(m) => m,
-            Err(e) => {
-                error!("Failed to create access token: {:?}", e);
-                return ApiError::InternalError.into_response();
-            }
-        };
+    let new_access_meta = match crate::auth::create_access_token_with_scope_metadata(
+        &session_row.did,
+        &key_bytes,
+        session_row.scope.as_deref(),
+    ) {
+        Ok(m) => m,
+        Err(e) => {
+            error!("Failed to create access token: {:?}", e);
+            return ApiError::InternalError.into_response();
+        }
+    };
     let new_refresh_meta =
         match crate::auth::create_refresh_token_with_metadata(&session_row.did, &key_bytes) {
             Ok(m) => m,
@@ -653,15 +665,17 @@ pub async fn confirm_signup(
             return ApiError::InternalError.into_response();
         }
     };
+    let no_scope: Option<String> = None;
     if let Err(e) = sqlx::query!(
-        "INSERT INTO session_tokens (did, access_jti, refresh_jti, access_expires_at, refresh_expires_at, legacy_login, mfa_verified) VALUES ($1, $2, $3, $4, $5, $6, $7)",
+        "INSERT INTO session_tokens (did, access_jti, refresh_jti, access_expires_at, refresh_expires_at, legacy_login, mfa_verified, scope) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
         row.did,
         access_meta.jti,
         refresh_meta.jti,
         access_meta.expires_at,
         refresh_meta.expires_at,
         false,
-        false
+        false,
+        no_scope
     )
     .execute(&state.db)
     .await
diff --git a/src/auth/mod.rs b/src/auth/mod.rs
index 8f195aa..ae1c01d 100644
--- a/src/auth/mod.rs
+++ b/src/auth/mod.rs
@@ -24,8 +24,8 @@ pub use service::{ServiceTokenClaims, ServiceTokenVerifier, is_service_token};
 pub use token::{
     SCOPE_ACCESS, SCOPE_APP_PASS, SCOPE_APP_PASS_PRIVILEGED, SCOPE_REFRESH, TOKEN_TYPE_ACCESS,
     TOKEN_TYPE_REFRESH, TOKEN_TYPE_SERVICE, TokenWithMetadata, create_access_token,
-    create_access_token_with_metadata, create_refresh_token, create_refresh_token_with_metadata,
-    create_service_token,
+    create_access_token_with_metadata, create_access_token_with_scope_metadata,
+    create_refresh_token, create_refresh_token_with_metadata, create_service_token,
 };
 pub use verify::{
     TokenVerifyError, get_did_from_token, get_jti_from_token, verify_access_token,
@@ -66,6 +66,11 @@ pub struct AuthenticatedUser {
 
 impl AuthenticatedUser {
     pub fn permissions(&self) -> ScopePermissions {
+        if let Some(ref scope) = self.scope
+            && scope != SCOPE_ACCESS
+        {
+            return ScopePermissions::from_scope_string(Some(scope));
+        }
         if !self.is_oauth {
             return ScopePermissions::from_scope_string(Some("atproto"));
         }
@@ -212,8 +217,8 @@ async fn validate_bearer_token_with_options_internal(
                     }
 
                     if !session_valid {
-                        let session_exists = sqlx::query_scalar!(
-                            "SELECT 1 as one FROM session_tokens WHERE did = $1 AND access_jti = $2 AND access_expires_at > NOW()",
+                        let session_row = sqlx::query!(
+                            "SELECT access_expires_at FROM session_tokens WHERE did = $1 AND access_jti = $2",
                             did,
                             jti
                         )
@@ -222,16 +227,24 @@ async fn validate_bearer_token_with_options_internal(
                         .ok()
                         .flatten();
 
-                        session_valid = session_exists.is_some();
-
-                        if session_valid && let Some(c) = cache {
-                            let _ = c
-                                .set(
-                                    &session_cache_key,
-                                    "1",
-                                    Duration::from_secs(SESSION_CACHE_TTL_SECS),
-                                )
-                                .await;
+                        match session_row {
+                            Some(row) => {
+                                if row.access_expires_at > chrono::Utc::now() {
+                                    session_valid = true;
+                                    if let Some(c) = cache {
+                                        let _ = c
+                                            .set(
+                                                &session_cache_key,
+                                                "1",
+                                                Duration::from_secs(SESSION_CACHE_TTL_SECS),
+                                            )
+                                            .await;
+                                    }
+                                } else {
+                                    return Err(TokenValidationError::TokenExpired);
+                                }
+                            }
+                            None => {}
                         }
                     }
 
@@ -241,7 +254,7 @@ async fn validate_bearer_token_with_options_internal(
                             key_bytes: Some(decrypted_key),
                             is_oauth: false,
                             is_admin,
-                            scope: None,
+                            scope: token_data.claims.scope.clone(),
                         });
                     }
                 }
diff --git a/src/auth/scope_check.rs b/src/auth/scope_check.rs
index 275a99d..e85706e 100644
--- a/src/auth/scope_check.rs
+++ b/src/auth/scope_check.rs
@@ -8,13 +8,22 @@ use crate::oauth::scopes::{
     AccountAction, AccountAttr, IdentityAttr, RepoAction, ScopePermissions,
 };
 
+use super::token::SCOPE_ACCESS;
+
+fn has_custom_scope(scope: Option<&str>) -> bool {
+    match scope {
+        None => false,
+        Some(s) => s != SCOPE_ACCESS,
+    }
+}
+
 pub fn check_repo_scope(
     is_oauth: bool,
     scope: Option<&str>,
     action: RepoAction,
     collection: &str,
 ) -> Result<(), Response> {
-    if !is_oauth {
+    if !is_oauth && !has_custom_scope(scope) {
         return Ok(());
     }
 
@@ -32,7 +41,7 @@ pub fn check_repo_scope(
 }
 
 pub fn check_blob_scope(is_oauth: bool, scope: Option<&str>, mime: &str) -> Result<(), Response> {
-    if !is_oauth {
+    if !is_oauth && !has_custom_scope(scope) {
         return Ok(());
     }
 
@@ -55,7 +64,7 @@ pub fn check_rpc_scope(
     aud: &str,
     lxm: &str,
 ) -> Result<(), Response> {
-    if !is_oauth {
+    if !is_oauth && !has_custom_scope(scope) {
         return Ok(());
     }
 
@@ -78,7 +87,7 @@ pub fn check_account_scope(
     attr: AccountAttr,
     action: AccountAction,
 ) -> Result<(), Response> {
-    if !is_oauth {
+    if !is_oauth && !has_custom_scope(scope) {
         return Ok(());
     }
 
@@ -100,7 +109,7 @@ pub fn check_identity_scope(
     scope: Option<&str>,
     attr: IdentityAttr,
 ) -> Result<(), Response> {
-    if !is_oauth {
+    if !is_oauth && !has_custom_scope(scope) {
         return Ok(());
     }
 
diff --git a/src/auth/token.rs b/src/auth/token.rs
index ac89848..49517f5 100644
--- a/src/auth/token.rs
+++ b/src/auth/token.rs
@@ -33,9 +33,18 @@ pub fn create_refresh_token(did: &str, key_bytes: &[u8]) -> Result<String> {
 }
 
 pub fn create_access_token_with_metadata(did: &str, key_bytes: &[u8]) -> Result<TokenWithMetadata> {
+    create_access_token_with_scope_metadata(did, key_bytes, None)
+}
+
+pub fn create_access_token_with_scope_metadata(
+    did: &str,
+    key_bytes: &[u8],
+    scopes: Option<&str>,
+) -> Result<TokenWithMetadata> {
+    let scope = scopes.unwrap_or(SCOPE_ACCESS);
     create_signed_token_with_metadata(
         did,
-        SCOPE_ACCESS,
+        scope,
         TOKEN_TYPE_ACCESS,
         key_bytes,
         Duration::minutes(15),
diff --git a/src/auth/verify.rs b/src/auth/verify.rs
index 7535561..b936e73 100644
--- a/src/auth/verify.rs
+++ b/src/auth/verify.rs
@@ -256,12 +256,7 @@ pub fn verify_access_token_typed(
     token: &str,
     key_bytes: &[u8],
 ) -> Result<TokenData<Claims>, TokenVerifyError> {
-    verify_token_typed_internal(
-        token,
-        key_bytes,
-        Some(TOKEN_TYPE_ACCESS),
-        Some(&[SCOPE_ACCESS, SCOPE_APP_PASS, SCOPE_APP_PASS_PRIVILEGED]),
-    )
+    verify_token_typed_internal(token, key_bytes, Some(TOKEN_TYPE_ACCESS), None)
 }
 
 fn verify_token_typed_internal(
@@ -307,7 +302,10 @@ fn verify_token_typed_internal(
     let verifying_key = VerifyingKey::from(&signing_key);
 
     let message = format!("{}.{}", header_b64, claims_b64);
-    if verifying_key.verify(message.as_bytes(), &signature).is_err() {
+    if verifying_key
+        .verify(message.as_bytes(), &signature)
+        .is_err()
+    {
         return Err(TokenVerifyError::Invalid);
     }
 
diff --git a/src/oauth/db/mod.rs b/src/oauth/db/mod.rs
index 14bdc31..436b807 100644
--- a/src/oauth/db/mod.rs
+++ b/src/oauth/db/mod.rs
@@ -26,7 +26,8 @@ pub use scope_preference::{
 pub use token::{
     check_refresh_token_used, count_tokens_for_user, create_token, delete_oldest_tokens_for_user,
     delete_token, delete_token_family, enforce_token_limit_for_user, get_token_by_id,
-    get_token_by_refresh_token, list_tokens_for_user, revoke_tokens_for_client, rotate_token,
+    get_token_by_previous_refresh_token, get_token_by_refresh_token, list_tokens_for_user,
+    revoke_tokens_for_client, rotate_token,
 };
 pub use two_factor::{
     TwoFactorChallenge, check_user_2fa_enabled, cleanup_expired_2fa_challenges,
diff --git a/src/oauth/db/token.rs b/src/oauth/db/token.rs
index f855b25..d325ec4 100644
--- a/src/oauth/db/token.rs
+++ b/src/oauth/db/token.rs
@@ -122,7 +122,7 @@ pub async fn rotate_token(
     )
     .fetch_one(&mut *tx)
     .await?;
-    if let Some(old_rt) = old_refresh {
+    if let Some(ref old_rt) = old_refresh {
         sqlx::query!(
             r#"
             INSERT INTO oauth_used_refresh_token (refresh_token, token_id)
@@ -137,13 +137,15 @@ pub async fn rotate_token(
     sqlx::query!(
         r#"
         UPDATE oauth_token
-        SET token_id = $2, current_refresh_token = $3, expires_at = $4, updated_at = NOW()
+        SET token_id = $2, current_refresh_token = $3, expires_at = $4, updated_at = NOW(),
+            previous_refresh_token = $5, rotated_at = NOW()
         WHERE id = $1
         "#,
         old_db_id,
         new_token_id,
         new_refresh_token,
-        new_expires_at
+        new_expires_at,
+        old_refresh
     )
     .execute(&mut *tx)
     .await?;
@@ -166,6 +168,48 @@ pub async fn check_refresh_token_used(
     Ok(row)
 }
 
+const REFRESH_GRACE_PERIOD_SECS: i64 = 60;
+
+pub async fn get_token_by_previous_refresh_token(
+    pool: &PgPool,
+    refresh_token: &str,
+) -> Result<Option<(i32, TokenData)>, OAuthError> {
+    let grace_cutoff = Utc::now() - chrono::Duration::seconds(REFRESH_GRACE_PERIOD_SECS);
+    let row = sqlx::query!(
+        r#"
+        SELECT id, did, token_id, created_at, updated_at, expires_at, client_id, client_auth,
+               device_id, parameters, details, code, current_refresh_token, scope
+        FROM oauth_token
+        WHERE previous_refresh_token = $1 AND rotated_at > $2
+        "#,
+        refresh_token,
+        grace_cutoff
+    )
+    .fetch_optional(pool)
+    .await?;
+    match row {
+        Some(r) => Ok(Some((
+            r.id,
+            TokenData {
+                did: r.did,
+                token_id: r.token_id,
+                created_at: r.created_at,
+                updated_at: r.updated_at,
+                expires_at: r.expires_at,
+                client_id: r.client_id,
+                client_auth: from_json(r.client_auth)?,
+                device_id: r.device_id,
+                parameters: from_json(r.parameters)?,
+                details: r.details,
+                code: r.code,
+                current_refresh_token: r.current_refresh_token,
+                scope: r.scope,
+            },
+        ))),
+        None => Ok(None),
+    }
+}
+
 pub async fn delete_token(pool: &PgPool, token_id: &str) -> Result<(), OAuthError> {
     sqlx::query!(
         r#"
diff --git a/src/oauth/endpoints/token/grants.rs b/src/oauth/endpoints/token/grants.rs
index d2195fa..86d130e 100644
--- a/src/oauth/endpoints/token/grants.rs
+++ b/src/oauth/endpoints/token/grants.rs
@@ -175,6 +175,36 @@ pub async fn handle_refresh_token_grant(
         "Refresh token grant requested"
     );
     if let Some(token_id) = db::check_refresh_token_used(&state.db, &refresh_token_str).await? {
+        if let Some((_db_id, token_data)) =
+            db::get_token_by_previous_refresh_token(&state.db, &refresh_token_str).await?
+        {
+            tracing::info!(
+                refresh_token_prefix = %&refresh_token_str[..std::cmp::min(16, refresh_token_str.len())],
+                "Refresh token reuse within grace period, returning existing tokens"
+            );
+            let dpop_jkt = token_data.parameters.dpop_jkt.as_deref();
+            let access_token = create_access_token(
+                &token_data.token_id,
+                &token_data.did,
+                dpop_jkt,
+                token_data.scope.as_deref(),
+            )?;
+            let mut response_headers = HeaderMap::new();
+            let config = AuthConfig::get();
+            let verifier = DPoPVerifier::new(config.dpop_secret().as_bytes());
+            response_headers.insert("DPoP-Nonce", verifier.generate_nonce().parse().unwrap());
+            return Ok((
+                response_headers,
+                Json(TokenResponse {
+                    access_token,
+                    token_type: if dpop_jkt.is_some() { "DPoP" } else { "Bearer" }.to_string(),
+                    expires_in: ACCESS_TOKEN_EXPIRY_SECONDS as u64,
+                    refresh_token: token_data.current_refresh_token,
+                    scope: token_data.scope,
+                    sub: Some(token_data.did),
+                }),
+            ));
+        }
         tracing::warn!(
             refresh_token_prefix = %&refresh_token_str[..std::cmp::min(16, refresh_token_str.len())],
             "Refresh token reuse detected, revoking token family"
diff --git a/tests/common/mod.rs b/tests/common/mod.rs
index 8f66028..d22c663 100644
--- a/tests/common/mod.rs
+++ b/tests/common/mod.rs
@@ -309,16 +309,12 @@ pub async fn verify_new_account(client: &Client, did: &str) -> String {
     let verification_code = lines
         .iter()
         .enumerate()
-        .find(|(_, line)| {
-            line.contains("verification code is:") || line.contains("code is:")
-        })
+        .find(|(_, line)| line.contains("verification code is:") || line.contains("code is:"))
         .and_then(|(i, _)| lines.get(i + 1).map(|s| s.trim().to_string()))
         .or_else(|| {
             body_text
                 .split_whitespace()
-                .find(|word| {
-                    word.contains('-') && word.chars().filter(|c| *c == '-').count() >= 3
-                })
+                .find(|word| word.contains('-') && word.chars().filter(|c| *c == '-').count() >= 3)
                 .map(|s| s.to_string())
         })
         .unwrap_or_else(|| body_text.clone());
diff --git a/tests/jwt_security.rs b/tests/jwt_security.rs
index f503ba9..324a38d 100644
--- a/tests/jwt_security.rs
+++ b/tests/jwt_security.rs
@@ -696,16 +696,12 @@ async fn test_refresh_token_replay_protection() {
     let code = lines
         .iter()
         .enumerate()
-        .find(|(_, line)| {
-            line.contains("verification code is:") || line.contains("code is:")
-        })
+        .find(|(_, line)| line.contains("verification code is:") || line.contains("code is:"))
         .and_then(|(i, _)| lines.get(i + 1).map(|s| s.trim().to_string()))
         .or_else(|| {
             body_text
                 .split_whitespace()
-                .find(|word| {
-                    word.contains('-') && word.chars().filter(|c| *c == '-').count() >= 3
-                })
+                .find(|word| word.contains('-') && word.chars().filter(|c| *c == '-').count() >= 3)
                 .map(|s| s.to_string())
         })
         .unwrap_or_else(|| body_text.clone());