@@ -58,7 +58,7 @@ If your instance is on an older version or you prefer not to create an OAuth app
 1. Go to **Settings → Developer Settings → Personal Tokens** in your Sentry instance (or visit `https://sentry.example.com/settings/account/api/auth-tokens/new-token/`)
 2. Create a new token with the following scopes:
 <!-- GENERATED:START oauth-scopes -->
-`project:read`, `project:write`, `project:admin`, `org:read`, `event:read`, `event:write`, `member:read`, `team:read`, `team:write`, `team:admin`, `alerts:read`, `alerts:write`
+`project:read`, `project:write`, `project:admin`, `org:read`, `org:integrations`, `event:read`, `event:write`, `member:read`, `team:read`, `team:write`, `team:admin`, `alerts:read`, `alerts:write`
 <!-- GENERATED:END oauth-scopes -->
 3. Pass it to the CLI:
 
 
@@ -16,9 +16,8 @@ sentry integration delete my-org/12345 --dry-run
 sentry integration delete my-org/12345 --yes
 ```
 
-Removing an integration requires the `org:integrations` or `org:admin` scope.
-The default `sentry auth login` scopes do not include it; re-authenticate with
-`sentry auth refresh --scope ...` including `org:integrations`, or use an auth
-token that has it.
+Removing an integration needs the `org:integrations` permission, which Sentry
+grants to org owners and managers. If your CLI login predates that scope,
+`sentry integration delete` asks you to re-authorize before removing anything.
 
 Installing new integrations from the CLI is not supported yet.
@@ -66,7 +66,7 @@ When creating your Sentry OAuth application:
 - **Scopes**: The CLI requests these scopes:
 <!-- GENERATED:START oauth-scopes -->
   - `project:read`, `project:write`, `project:admin`
-  - `org:read`
+  - `org:read`, `org:integrations`
   - `event:read`, `event:write`
   - `member:read`
   - `team:read`, `team:write`, `team:admin`
 
@@ -12,17 +12,21 @@ import { deleteIntegration, getIntegration } from "../../lib/api-client.js";
 import { ApiError, ContextError, ValidationError } from "../../lib/errors.js";
 import { renderMarkdown, safeCodeSpan } from "../../lib/formatters/markdown.js";
 import { CommandOutput } from "../../lib/formatters/output.js";
+import { runInteractiveLogin } from "../../lib/interactive-login.js";
 import {
   buildDeleteCommand,
   confirmByTyping,
   isConfirmationBypassed,
 } from "../../lib/mutate-command.js";
-import { OAUTH_SCOPES } from "../../lib/oauth.js";
 import { resolveOrg } from "../../lib/resolve-target.js";
+import { ensureScopesForAction } from "../../lib/scope-recovery.js";
 
 const USAGE_HINT = "sentry integration delete [<org>/]<integration-id>";
 
-/** Scope Sentry requires (besides org:admin) to uninstall an integration. */
+/**
+ * Scope Sentry requires (besides org:admin) to uninstall an integration.
+ * Part of the CLI's default scopes, but logins from before it was added lack it.
+ */
 const DELETE_SCOPE = "org:integrations";
 
 const INTEGRATION_ID_RE = /^\d+$/;
@@ -86,22 +90,28 @@ export function parseIntegrationArg(arg: string | undefined): {
 }
 
 /**
- * Turn a 403 into actionable guidance: the CLI's default OAuth login does not
- * request `org:integrations`, and Sentry's 403 body doesn't name the scope.
+ * Explain a 403 from the delete call. Sentry's 403 body names neither the
+ * scope nor the role, and the generic hint ("re-authenticate") doesn't help
+ * when the user's org role is what's missing.
+ *
+ * @param scopeMissing - The stored login lacks the scope and couldn't be
+ *   elevated here (no interactive terminal)
  */
-function enrichDeleteError(error: unknown): unknown {
-  if (error instanceof ApiError && error.status === 403) {
-    const scopes = [...OAUTH_SCOPES, DELETE_SCOPE].join(",");
-    return new ApiError(
-      "Not allowed to remove this integration",
-      403,
-      `Removing integrations requires the '${DELETE_SCOPE}' or 'org:admin' scope and an owner or manager role.\n  ` +
-        `Re-authenticate with: sentry auth refresh --scope ${scopes}\n  ` +
-        "Or use an auth token that has the 'org:integrations' scope.",
-      error.endpoint,
-    );
+function enrichDeleteError(error: unknown, scopeMissing: boolean): unknown {
+  if (!(error instanceof ApiError && error.status === 403)) {
+    return error;
   }
-  return error;
+  const detail = scopeMissing
+    ? `Your saved login predates the '${DELETE_SCOPE}' scope, and authorization can't be updated without an interactive terminal.\n  ` +
+      `Run this command in a terminal to re-authorize, or use an auth token with the '${DELETE_SCOPE}' scope.`
+    : `Removing integrations requires the '${DELETE_SCOPE}' permission, which Sentry grants to org owners and managers.\n  ` +
+      `If you use an auth token, make sure it has the '${DELETE_SCOPE}' scope.`;
+  return new ApiError(
+    "Not allowed to remove this integration",
+    403,
+    detail,
+    error.endpoint,
+  );
 }
 
 export const deleteCommand = buildDeleteCommand({
@@ -111,7 +121,8 @@ export const deleteCommand = buildDeleteCommand({
       "Uninstall an integration from an organization. Sentry also removes the " +
       "integration's linked issues and stops syncing with the provider.\n\n" +
       "Find the integration ID with `sentry integration list`.\n\n" +
-      "Requires the org:integrations or org:admin scope.\n\n" +
+      "Needs the org:integrations permission (org owners and managers). If your " +
+      "login predates that scope, the CLI asks you to re-authorize first.\n\n" +
       "Examples:\n" +
       "  sentry integration delete 12345\n" +
       "  sentry integration delete my-org/12345\n" +
@@ -156,6 +167,18 @@ export const deleteCommand = buildDeleteCommand({
       return;
     }
 
+    // Elevate before confirming so an older login authorizes once instead of
+    // failing with 403 and re-running the prompt via scope recovery.
+    const elevation = await ensureScopesForAction(
+      [DELETE_SCOPE],
+      "Removing an integration",
+      runInteractiveLogin,
+    );
+    if (elevation === "declined") {
+      yield new CommandOutput(result);
+      return { hint: "Authorization was not completed. Nothing was removed." };
+    }
+
     // Confirmation gate — non-interactive guard is handled by buildDeleteCommand
     if (!isConfirmationBypassed(flags)) {
       const confirmed = await confirmByTyping(
@@ -171,7 +194,7 @@ export const deleteCommand = buildDeleteCommand({
     try {
       await deleteIntegration(org, id);
     } catch (error) {
-      throw enrichDeleteError(error);
+      throw enrichDeleteError(error, elevation === "unavailable");
     }
     yield new CommandOutput({ ...result, deleted: true });
   },
 
@@ -90,6 +90,7 @@ export const OAUTH_SCOPES: readonly string[] = [
   "project:write",
   "project:admin",
   "org:read",
+  "org:integrations",
   "event:read",
   "event:write",
   "member:read",
@@ -108,8 +109,9 @@ const SCOPES = OAUTH_SCOPES.join(" ");
  *
  * Derived by keeping only scopes whose action is `:read`. This assumes every
  * read-granting scope the CLI requests carries the `:read` suffix — true for
- * the current list. If a future read-ish scope without that suffix is added to
- * `OAUTH_SCOPES` (e.g. `org:integrations`), update this filter explicitly.
+ * the current list. `org:integrations` grants install/uninstall, so excluding
+ * it here is intended. If a future read-ish scope without that suffix is
+ * added to `OAUTH_SCOPES`, update this filter explicitly.
  */
 const OAUTH_SCOPES_READ_ONLY: readonly string[] = OAUTH_SCOPES.filter((scope) =>
   scope.endsWith(":read"),
 
@@ -148,6 +148,65 @@ export async function ensureCurrentOAuthScopes(
   return await refreshOAuthScopes(state, runInteractiveLogin, runtime);
 }
 
+/**
+ * Outcome of {@link ensureScopesForAction}.
+ *
+ * - `ready`: the token already has the scopes, or it isn't a stored OAuth
+ *   grant the CLI can elevate (env/auth tokens), or the check itself failed.
+ *   Callers proceed and let the API decide.
+ * - `elevated`: the user re-authorized and the new grant is stored.
+ * - `unavailable`: elevation is needed but prompts aren't possible here.
+ * - `declined`: the authorization flow failed or was cancelled.
+ */
+export type ScopeElevationResult =
+  | "ready"
+  | "elevated"
+  | "unavailable"
+  | "declined";
+
+/**
+ * Make sure the stored OAuth grant has `required` before running an action.
+ *
+ * Commands that need a default scope older logins may lack call this before
+ * any confirmation prompt, so the user authorizes once instead of hitting a
+ * 403 and re-running the command (and its prompts) through
+ * {@link runWithScopeRecovery}. The device flow requests the CLI's default
+ * scopes, so `required` must be a subset of {@link OAUTH_SCOPES}.
+ *
+ * @param required - Scopes the action needs
+ * @param action - Human description for the prompt, e.g. "Removing an integration"
+ */
+export async function ensureScopesForAction(
+  required: readonly string[],
+  action: string,
+  runInteractiveLogin: InteractiveLogin,
+  runtime: ScopeRecoveryRuntime = defaultRuntime,
+): Promise<ScopeElevationResult> {
+  let missing: string[];
+  try {
+    if (runtime.getAuthSource() !== "oauth") {
+      return "ready";
+    }
+    const granted = new Set((await runtime.getAuthScopes()) ?? []);
+    missing = required.filter((scope) => !granted.has(scope));
+  } catch (error) {
+    logger.debug("Could not inspect OAuth scopes before action", error);
+    return "ready";
+  }
+  if (missing.length === 0) {
+    return "ready";
+  }
+  if (!(runtime.inputIsTty() && runtime.promptsAllowed())) {
+    return "unavailable";
+  }
+
+  runtime.assertTrustedHost();
+  runtime.write(
+    `${action} needs elevated permissions (${missing.join(", ")}). Starting authorization...\n\n`,
+  );
+  return (await runInteractiveLogin()) ? "elevated" : "declined";
+}
+
 /** Check an OAuth token after a 401/403, re-authorize if needed, and retry once. */
 export async function runWithScopeRecovery(
   proceed: (commandArgs: string[]) => Promise<void>,
 
@@ -41,6 +41,15 @@ vi.mock("../../../src/lib/resolve-target.js", async (importOriginal) => {
 // oxlint-disable-next-line sentry-cli/no-namespace-import -- needed for spyOn mocking
 import * as resolveTarget from "../../../src/lib/resolve-target.js";
 
+vi.mock("../../../src/lib/scope-recovery.js", async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import("../../../src/lib/scope-recovery.js")>();
+  return { ...actual, ensureScopesForAction: vi.fn() };
+});
+
+// oxlint-disable-next-line sentry-cli/no-namespace-import -- needed for vi.mocked access
+import * as scopeRecovery from "../../../src/lib/scope-recovery.js";
+
 const sampleIntegration = {
   id: "42",
   name: "getsentry",
@@ -87,8 +96,10 @@ describe("integration delete", () => {
   let getSpy: ReturnType<typeof vi.spyOn>;
   let deleteSpy: ReturnType<typeof vi.spyOn>;
   let resolveOrgSpy: ReturnType<typeof vi.spyOn>;
+  const ensureScopesSpy = vi.mocked(scopeRecovery.ensureScopesForAction);
 
   beforeEach(() => {
+    ensureScopesSpy.mockResolvedValue("ready");
     getSpy = vi.spyOn(apiClient, "getIntegration");
     deleteSpy = vi.spyOn(apiClient, "deleteIntegration");
     resolveOrgSpy = vi.spyOn(resolveTarget, "resolveOrg");
@@ -101,6 +112,7 @@ describe("integration delete", () => {
     getSpy.mockRestore();
     deleteSpy.mockRestore();
     resolveOrgSpy.mockRestore();
+    ensureScopesSpy.mockReset();
   });
 
   test("removes the integration with --yes", async () => {
@@ -114,12 +126,37 @@ describe("integration delete", () => {
     expect(output(stdoutWrite)).toContain("Removed GitHub integration");
   });
 
+  test("elevates to org:integrations before deleting", async () => {
+    ensureScopesSpy.mockResolvedValue("elevated");
+    const { context } = createMockContext();
+    const func = await deleteCommand.loader();
+    await func.call(context, yesFlags, "my-org/42");
+
+    expect(ensureScopesSpy).toHaveBeenCalledWith(
+      ["org:integrations"],
+      "Removing an integration",
+      expect.any(Function),
+    );
+    expect(deleteSpy).toHaveBeenCalledWith("my-org", "42");
+  });
+
+  test("does not delete when authorization is declined", async () => {
+    ensureScopesSpy.mockResolvedValue("declined");
+    const { context, stdoutWrite } = createMockContext();
+    const func = await deleteCommand.loader();
+    await func.call(context, { ...yesFlags, json: true }, "my-org/42");
+
+    expect(deleteSpy).not.toHaveBeenCalled();
+    expect(JSON.parse(output(stdoutWrite))).toMatchObject({ deleted: false });
+  });
+
   test("dry-run does not delete", async () => {
     const { context, stdoutWrite } = createMockContext();
     const func = await deleteCommand.loader();
     await func.call(context, { ...yesFlags, "dry-run": true }, "my-org/42");
 
     expect(deleteSpy).not.toHaveBeenCalled();
+    expect(ensureScopesSpy).not.toHaveBeenCalled();
     expect(output(stdoutWrite)).toContain("Would remove");
   });
 
@@ -147,7 +184,7 @@ describe("integration delete", () => {
     expect(deleteSpy).not.toHaveBeenCalled();
   });
 
-  test("explains the missing org:integrations scope on 403", async () => {
+  test("explains the role requirement on a 403 that survives elevation", async () => {
     deleteSpy.mockRejectedValue(new ApiError("Forbidden", 403));
     const { context } = createMockContext();
     const func = await deleteCommand.loader();
@@ -157,7 +194,21 @@ describe("integration delete", () => {
       .catch((e: unknown) => e);
     expect(error).toBeInstanceOf(ApiError);
     expect((error as ApiError).detail).toContain("org:integrations");
-    expect((error as ApiError).detail).toContain("sentry auth refresh --scope");
+    expect((error as ApiError).detail).toContain("owners and managers");
+  });
+
+  test("explains the missing scope on a 403 when elevation was unavailable", async () => {
+    ensureScopesSpy.mockResolvedValue("unavailable");
+    deleteSpy.mockRejectedValue(new ApiError("Forbidden", 403));
+    const { context } = createMockContext();
+    const func = await deleteCommand.loader();
+
+    const error = await func
+      .call(context, yesFlags, "my-org/42")
+      .catch((e: unknown) => e);
+    expect(error).toBeInstanceOf(ApiError);
+    expect((error as ApiError).detail).toContain("predates");
+    expect((error as ApiError).detail).toContain("interactive terminal");
   });
 
   test("throws ContextError when no org can be resolved", async () => {
 
@@ -119,6 +119,11 @@ describe("resolveOAuthScopeString", () => {
     expect(OAUTH_SCOPES).toContain("team:admin");
   });
 
+  test("default scopes include org:integrations but not org:admin", () => {
+    expect(OAUTH_SCOPES).toContain("org:integrations");
+    expect(OAUTH_SCOPES).not.toContain("org:admin");
+  });
+
   test("default (no selection) returns the full OAUTH_SCOPES set", () => {
     expect(resolveOAuthScopeString()).toBe(OAUTH_SCOPES.join(" "));
     expect(resolveOAuthScopeString({})).toBe(OAUTH_SCOPES.join(" "));