Someone could steal your token, and cause a lot of problems…
You should only ever request the scopes you need for your application to function
No you’d have to add all of them to your URL, there is no “all scopes” shortcut.
Because, you should only ever request the scopes you need.