...
Actionstep supports the Authorization grant type only (other methods may be introduced in the future). The Authorization grant type requires the client to direct the end-user to Actionstep's API authorization page. This will be followed by a second page where the end-user will authorize the client to access their system based on the specified scope.
...
The scope can either be set server-side, or on a request-by-request basis. Before granting access to the client application, the end-user will be shown the scope for which the client application is requesting access.
...