EOS_Auth_Login fails with scope_not_found on basic_profile despite Application Permissions being enabled

General Issues and Bug Reporting (Unreal Engine)
,
1

Summary

Product: FPMovementV1
Client ID: xyza7891PJYGIc8rGXGzkCLsbQn98Jwx
Product ID: 38666f8e9f3d4827adfdf1e286913bbd
Sandbox ID: p-4v5zpzezcx9l95gkjrjrx36rjef3bv
Deployment ID: e655a5da26e04af9951421c25765d8eb
Engine: Unreal Engine 5.8.1, EOS SDK 1.19.1.2, using the OnlineSubsystemEOS plugin (not the newer OnlineServices EOS plugin)

Issue:
Every EOS_Auth_Login call using the AccountPortal credential type fails during token exchange with:

ServiceName=[OAuth], OperationName=[TokenGrantv2], HttpStatus=[400]
ErrorCode=[errors.com.epicgames.oauth.scope_not_found], NumericErrorCode=[58004]
ErrorMessage=[The specified scope basic_profile offline_access openid does not exist.]

This happens even when the login is configured to request only basic_profile (via AuthScopeFlags=BasicProfile in DefaultEngine.ini, no FriendsList/Presence requested). openid/offline_access are baseline scopes the SDK appends automatically for AccountPortal logins.

I’ve confirmed via the Dev Portal’s Application Permissions panel for this product that Basic Profile, Online Presence, Friends List, and Country are all already enabled — so this doesn’t appear to be a permissions-toggle issue. The error is happening before any user consent screen is even shown (fails at token exchange, not with scope_consent_required), which suggests the scope isn’t recognized/registered for this specific OAuth client at all.

What Type of Bug are you experiencing?

Networking

Steps to Reproduce

Steps to reproduce:

  1. In a UE 5.8 project with OnlineSubsystemEOS configured with the above IDs and bUseEAS=True.
  2. Call Online|AdvancedIdentity|LoginUser with AuthType accountportal, empty Id/Token.
  3. Browser opens (overlay disabled), user completes the device-code / Account Portal login for a valid Epic account.
  4. Token exchange fails with the error above, on both a Server-role and Client-role PIE instance, and with two different Epic accounts (ruling out an account-specific issue).

Expected Result

Not receiving error message

Observed Result

CorrIds from affected requests (for server-side tracing):

  • EOS-9vGgs-GJSUCwFnpW-vQ6kA-mHviLMxf9UezuLKa9oKRdg
  • EOS-9vGgs-GJSUCwFnpW-vQ6kA-FbtF0otqG0qWfXlyGJLdcA
  • EOS-9vGgs-GJSUCwFnpW-vQ6kA-hUbIQq_wvkWdetxF-TsH1w
  • EOS-9vGgs-GJSUCwFnpW-vQ6kA-i0IEAfFV8k2k7iaPTJw0Kw

What I’ve already ruled out:

  • Not an Application Permissions config issue (already enabled, screenshot available on request).
  • Not a client-side plugin bug — login call matches Epic’s documented OSS EOS AccountPortal pattern exactly (verified against your own docs).
  • Not related to EOS Plus / external account linking — that plugin isn’t enabled in this project.
  • Reproduces identically across two separate Epic accounts and two different PIE client roles, ruling out an account-specific consent issue.

Affects Versions

5.8

Platform(s)

Windows

2

scope_not_found on basic_profile is almost never a code issue — it means the scope isn’t actually granted for your product client. The usual culprit, in order:

  1. Epic Account Services not fully enabled: dev.epicgames.com > your product > Product Settings > Epic Account Services — Basic Profile has to be enabled there, AND the age rating questionnaire must be submitted. Until age rating is complete, basic_profile stays unavailable and the token exchange returns scope_not_found even when client permissions look right. This catches almost everyone.
    1. Client policy scopes: Product Settings > Clients > your client > its attached policy — the Allowed Scopes list must actually contain basic_profile. Permissions on the product aren’t the same as scopes on the client policy.
      1. Propagation: after enabling, give it a few minutes, then retry.
        1. Confirm the Client ID used at runtime belongs to this product’s sandbox — a client from another product/config fails around auth too.
      3. With OnlineSubsystemEOS + AccountPortal there’s nothing extra to set in DefaultEngine.ini for scopes — the granted scopes come from the client’s policy server-side. So: enable Epic Account Services (Basic Profile + age rating), add basic_profile to the client policy, wait a few minutes, retry EOS_Auth_Login. If it still fails, log into the portal and check the actual policy JSON on the client — sometimes a second policy is attached than the one you edited.