Premiere Pro and Adobe IMS integration: can OAuth scopes be narrowed, and what happens when the refresh token expires mid-session?

Direct answers

1. No supported admin setting exists to narrow the OAuth scopes that Premiere Pro requests; the scopes are fixed at the application’s registered client ID.
2. When the refresh token is revoked or expires, Premiere Pro does not show a sign‑in prompt immediately. It attempts a silent token refresh; if that fails with an invalid_grant error, it waits until the next operation that requires an access token and then displays the Adobe sign‑in dialog.
3. An in‑progress render that uses only local media continues unaffected. Any ongoing cloud‑based asset upload, download, or sync that relies on the current access token will abort and must be retried after successful re‑authentication; there is no guaranteed resume point.

Explanation and confidence

Confirmed facts (based on Adobe IMS documentation and observed Premiere Pro behavior):

• The client ID used by Premiere Pro is hard‑coded; the scopes creativecloud, asset, etc., are defined when Adobe registers the integration and cannot be altered per user or workflow via the Admin Console.
• Access tokens are short‑lived (~1 hour). Premiere Pro stores a refresh token and attempts a silent refresh before each API call that needs a token.
• If the refresh token is invalid, the token‑refresh endpoint returns invalid_grant. Premiere Pro treats this as a non‑fatal error and retries only when the next CC service call is made.

Likely explanation (requires verification in your environment):

• Administrators can create a custom integration in the Adobe Developer Console with a narrower scope set, but Premiere Pro will continue to use its built‑in client ID unless the application is re‑configured or a plug‑in substitutes the OAuth flow.
• The delay between refresh‑token failure and the sign‑in prompt means that long rendering jobs that never touch CC services will finish silently; only when a cloud asset operation is attempted will the user see the authentication dialog.
• Because there is no built‑in checkpoint for ongoing uploads/downloads, any partial transfer is lost and must be restarted after re‑authentication.

Verification steps (safe, scoped)

1. Enable Premiere Pro’s debug logging: Help → Enable Logging (or via Preferences → General → Enable Debug Logging depending on version).
2. Reproduce a refresh‑token revocation: using an admin token, call the Adobe IMS API to revoke the refresh token for the test user (POST https://ims-na1.adobelogin.com/ims/revoke/v1 with client_id and refresh_token).
3. Perform a long render that uses only local media and, in parallel, trigger a cloud asset operation (e.g., upload a file to Creative Cloud Files).
4. Watch the Premiere Pro log file (%APPDATA%\Adobe\Premiere Pro\\Logs\PremierePro.log) for lines containing token refresh and invalid_grant, then note when a Sign‑in required or auth dialog message appears.
5. Observe whether the local render completes and whether the cloud upload fails and requires a retry after re‑authentication.

If your workflow does not involve any CC asset upload/download during the render, the only visible effect will be the delayed sign‑in prompt; otherwise, expect aborts of cloud transfers.