You don't necessarily need OAuth2 scopes, and you can handle authentication and authorization however you want.

    But OAuth2 with scopes can be nicely integrated into your API (with OpenAPI) and your API docs.

    Nevertheless, you still enforce those scopes, or any other security/authorization requirement, however you need, in your code.