Answer
Some OAuth flows use a resource or audience parameter to indicate which API the token should be valid for, separate from the requested scope — if it's being ignored, confirm your identity provider's flow actually expects that parameter in the first place, since not every configuration uses it the same way. See authenticate and get access.