What I'm wondering about is, what will happen if you request certain permissions (e.g. w_messages / rw_groups ) as part of the oauth process, but do not actually call API endpoints that require them.

The documentation just mentions the limitation in API endpoints, but I'm a bit worried whether it could make the oauth login fail due to permissions requested that you can no longer use.