oauth gen + scope + endpoint protection done