title: Laravel Passport invalid scope(s) provided exception
body: <ul>
  <li>Laravel Passport version 8.0.0</li>
  <li>Laravel version: 6.2</li>
  </ul>
  
  <p>I defined scopes of my API using the <code>Passport::tokensCan</code> method in the boot method of <code>AuthServiceProvider.php</code> file:</p>
  
  <pre><code>Passport::routes();
  
  Passport::tokensCan([
      'view-posts' =&gt; 'View posts',
      'create-posts' =&gt; 'Create posts'
  ]);
  </code></pre>
  
  <p>Added the following middleware to the <code>$routeMiddleware</code> property of <code>app/Http/Kernel.php</code> file:</p>
  
  <pre><code>protected $routeMiddleware = [
      'auth' =&gt; \App\Http\Middleware\Authenticate::class,
      'auth.basic' =&gt; \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
      /*
      . . .
      */
      'scopes' =&gt; \Laravel\Passport\Http\Middleware\CheckScopes::class,
      'scope' =&gt; \Laravel\Passport\Http\Middleware\CheckForAnyScope::class,
  ];
  </code></pre>
  
  <p>Then, I protected an API route in <code>routes/api.php</code>:</p>
  
  <pre><code>Route::post('/posts', [
      'uses' =&gt; 'PostController@store',
      'middleware' =&gt; ['auth:api', 'scope:create-posts']
  ]);
  </code></pre>
  
  <p>In a client app, my authorization route is (<code>routes/web.php</code>):</p>
  
  <pre><code>Route::middleware(['auth'])-&gt;group(function () {
      Route::get('/auth/blogger', 'BloggerAuthController@redirect');
      Route::get('/auth/blogger/callback', 'BloggerAuthController@callback');
  });
  </code></pre>
  
  <p>And <code>BloggerAuthController</code> controller is like so:</p>
  
  <pre><code>&lt;?php
  
  namespace App\Http\Controllers;
  
  use Illuminate\Http\Request;
  use GuzzleHttp\Client as Guzzle;
  
  class BloggerAuthController extends Controller
  {
      protected $client;
  
      public function __construct(Guzzle $client)
      {
          $this-&gt;client = $client;
      }
  
      public function redirect()
      {
          $query = http_build_query([
              'client_id' =&gt; '3',
              'redirect_uri' =&gt; 'http://localhost:8001/auth/blogger/callback',
              'response_type' =&gt; 'code',
              'scope' =&gt; 'view-posts'
          ]);
  
          return redirect('http://localhost:8000/oauth/authorize?' . $query);
      }
  
      public function callback(Request $request)
      {
          $response = $this-&gt;client-&gt;post('http://localhost:8000/oauth/token', [
              'form_params' =&gt; [
                  'grant_type' =&gt; 'authorization_code',
                  'client_id' =&gt; '3',
                  'client_secret' =&gt; 'gG5HcVn1JlGhzO0RfgTfWuqP8IVro1Qhu9g2q0Dq',
                  'redirect_uri' =&gt; 'http://localhost:8001/auth/blogger/callback',
                  'code' =&gt; $request-&gt;code
              ]
          ]);
  
          $response = json_decode($response-&gt;getBody());
  
          $request-&gt;user()-&gt;token()-&gt;delete();
  
          $request-&gt;user()-&gt;token()-&gt;create([
              'access_token' =&gt; $response-&gt;access_token
          ]);
  
          return redirect('/home');
      }
  }
  </code></pre>
  
  <p>When I (<code>POST</code>) request to <code>/api/posts</code> from my client app,
  I get an exception:</p>
  
  <pre><code>{
      "message": "Invalid scope(s) provided.",
      "exception": "Symfony\\Component\\HttpKernel\\Exception\\AccessDeniedHttpException",
      "file": "C:\\Users\\nbayramberdiyev\\Desktop\\fresh\\vendor\\laravel\\framework\\src\\Illuminate\\Foundation\\Exceptions\\Handler.php",
      "line": 206,
      /*
      . . .
      */
  }
  </code></pre>
  
  <p>But the expected result would be:</p>
  
  <pre><code>{
      "message": "Unauthenticated."
  }
  </code></pre>
  
  <p>with status 401.</p>
  
  <p>Why is this happening? Did I miss anything in <a href="https://laravel.com/docs/6.x/passport#token-scopes" rel="noreferrer">docs</a>?</p>