Fusio

This happens when no scope parameter is sent: Fusio inserts all scopes granted to the app as a comma-separated string into fusio_token.scope, which is limited to 1023 characters. Workaround: request only the required scopes explicitly, for example:

curl -X POST https://your-fusio/authorization/token \
  -u "APP_KEY:APP_SECRET" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=client_credentials&scope=backend.user,backend.action'

Also avoid assigning broad root scopes such as backend when narrower scopes such as backend.user are sufficient, because root scopes expand into many sub-scopes. Remove unused grants from the app/user.

For self-hosted PostgreSQL, the column can be widened manually if long scope lists are required:

ALTER TABLE fusio_token ALTER COLUMN scope TYPE TEXT;
ALTER TABLE fusio_app_code ALTER COLUMN scope TYPE TEXT;

Newer Fusio releases add an explicit exception when the scope string exceeds the column limit, making the cause clearer, but the immediate workaround is to send a shorter explicit scope or reduce granted scopes.