Partly a question if there's any reason why the API requires owned strings for constructors and such.

.add_scope(Scope::new("read".to_string()))
.add_scope(Scope::new("write".to_string()))

Could then become:

.add_scope(Scope::new("read"))
.add_scope(Scope::new("write"))

And the method signature would still make it clear that an allocation will take place.

This also applies to the oath2 crate.