You changed the scopes required by your application and this change has been approved. Then, the authentication will not be allowed as long as the scopes required on the previous refresh_token are different from the scopes currently existing on the application. You will need to ask for a new authentication with the grant_type “authorization_code”, so the user can give his consent on the new provided scopes