I have a similar problem as Podio authentication read permisson but could not comment there so am posting a new question.
Whenever I redirect a user to Podio to grant us API access, podio does not seem to care about the ?scope=
argument.
Example url:
https://podio.com/oauth/authorize?scope=user:read&client_id=....&redirect_uri=..
see screenshot