OAuth2-具有范围的客户端凭据授予

Question

我正在使用软件包thephpleague/oauth2-client作为README.md的“客户证书授予”示例，并且我试图通知名为 cbnpagamento_vendas 的特定范围，显然没有成功，例如：

use League\OAuth2\Client\Provider\GenericProvider;

$options = [
    'clientId' => 'xxx',
    'clientSecret' => 'xxx',
    'urlAuthorize' => 'https://apigw-h.bndes.gov.br/token',
    'urlAccessToken' => 'https://apigw-h.bndes.gov.br/token',
    'urlResourceOwnerDetails' => 'https://apigw-h.bndes.gov.br/cbn-fornecedor',
    'scopes' => ['cbnpagamento_vendas'],
];

$prov = new GenericProvider($options);
$token = $prov->getAccessToken('client_credentials');
var_dump($token);

我得到：

class League\OAuth2\Client\Token\AccessToken#32 (5) {
  protected $accessToken =>
  string(36) "7b27b500-89a2-36b8-8f9c-xxx"
  protected $expires =>
  int(1551893968)
  protected $refreshToken =>
  NULL
  protected $resourceOwnerId =>
  NULL
  protected $values =>
  array(2) {
    'scope' =>
    string(28) "am_application_scope default"       <== HERE!
    'token_type' =>
    string(6) "Bearer"
  }
}

我相信我应该拥有 cbnpagamento_vendas 范围，对吧？

我在做什么错了？

谢谢！