I needed to add another verify_scope function to check the requested scope with that associated with the refresh token, see line 311 in oauth2.erl. I looked for a way of substituting the existing verify_client_scope and verify_resowner_scope with this more generic function; but the library can't get the scope from a client or resource-owner because the data structures representing these are defined in the particular back-end implementation.