Tables DDL doesnt match original about api-tools-oauth2 HOT 1 OPEN

As for the missing PK:
As defined in RFC 6749#3.3, a scope is a space delimited list of values, whose order doesn't matter.
You can also see that at this line, the scope "reference" is a 4000 string... IMHO, there's no point of making that column a primary key. Maybe adding an UNIQUE constraint if you care about unicity. Also, in general, there's not that amount of scopes to leverage INDEX SQL features.
As for other fields:
Again, RFC does not precise the scope of the scopes :) It's up to the resource owner to define the business implementation of the scopes. So extra columns with no constraints does not interfere with OAuth2 authorization workflow.

Originally posted by @jguittard at zfcampus/zf-oauth2#142 (comment)

from api-tools-oauth2.