A method comprising: receiving, at an OAuth authorization computer system, a request to access a resource server from a client application that executes in a context of an identity domain of a plurality of identity domains; identifying, at the OAuth authorization computer system, an OAuth service profile that is applicable only to the identity domain of the plurality of identity domains, wherein the OAuth service profile includes information identifying a set of resource servers that the client application is permitted to access in the context of the identity domain; determining, at the OAuth authorization computer system and based on the set of resource servers identified by the information in the OAuth service profile, whether the client application is permitted to access the resource server in the context of the identity domain, wherein the client application is permitted access to the resource server upon determining that the resource server is included in the set of resource servers; upon determining that the client application is not permitted to access the resource server in the context of the identity domain, denying, at the OAuth authorization computer system, the request to access the resource server, wherein denying the request to access the resource server includes blocking communication from the client application to the resource server in the context of the identity domain; upon determining that the client application is permitted to access the resource server in the context of the identity domain, accessing, at the OAuth authorization computer system, the resource server to obtain scope information for the resource server; and generating, at the OAuth authorization computer system, based on the scope information obtained from the resource server, a token for the client application to access the resource server. receiving, at an OAuth authorization computer system, a request to access a resource server from a client application that executes in a context of an identity domain of a plurality of identity domains; identifying, at the OAuth authorization computer system, an OAuth service profile that is applicable only to the identity domain of the plurality of identity domains, wherein the OAuth service profile includes information identifying a set of resource servers that the client application is permitted to access in the context of the identity domain; determining, at the OAuth authorization computer system and based on the set of resource servers identified by the information in the OAuth service profile, whether the client application is permitted to access the resource server in the context of the identity domain, wherein the client application is permitted access to the resource server upon determining that the resource server is included in the set of resource servers; upon determining that the client application is not permitted to access the resource server in the context of the identity domain, denying, at the OAuth authorization computer system, the request to access the resource server, wherein denying the request to access the resource server includes blocking communication from the client application to the resource server in the context of the identity domain; upon determining that the client application is permitted to access the resource server in the context of the identity domain, accessing, at the OAuth authorization computer system, the resource server to obtain scope information for the resource server; and generating, at the OAuth authorization computer system, based on the scope information obtained from the resource server, a token for the client application to access the resource server.