A scope is a specific, named permission a client is requesting — email, profile, calendar.readonly, repo (on GitHub). Scopes exist so a user (and the authorization server's consent screen) can see and approve exactly what's being requested, rather than granting a client blanket access to everything on the account.
GET https://accounts.google.com/o/oauth2/v2/auth
?client_id=your-client-id
&redirect_uri=https://yourapp.com/callback
&response_type=code
&scope=openid%20email%20profile
&state=xyz123
&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
&code_challenge_method=S256
The principle of least privilege applies directly here: request the narrowest scope that actually accomplishes what your application does. Requesting https://www.googleapis.com/auth/drive (full Drive access) when the app only ever reads one specific file is both a worse user experience (a scarier consent screen) and a larger blast radius if the resulting access token is ever leaked. Scopes granted are also exactly what an access token's claims (or, for OAuth, what the resource server checks against) should be validated against on every API call — a token being valid is a separate question from whether it was ever granted the scope the current request actually needs.