title: Define and validate custom scopes in WSO2IS
body: <p>I am using the OAuth2.0 for authentication and authorization with the WSO2IS. I have multiple APIs on the ESB. There, the user may grant access to API1 and API2, but not to API3.</p>
  
  <p>Is it possible to define custom scopes to limit the client from accessing all APIs?</p>
  
  <p>If it is not possible, how do I protect the APIs from unauthorized access?</p>
  
  <p>Side note: currently, I may only limit the access by defining different applications. However, this isn't suitable, because I must then manage multiple clientIDs and clientSecrets on the client side.</p>