Extract granted scopes: OAuth uses a space-delimited scope string; some issuers use scp (string or array).
Extract granted scopes: OAuth uses a space-delimited scope string; some issuers use scp (string or array).