Once authenticated, I don't see a way to get the scope of the OAuth token that was used. More generally, I don't see how to fetch all the authorization tokens for the user.

I believe that should be doable: https://developer.github.com/v3/oauth_authorizations/#list-your-authorizations .