diff --git a/shortcuts/im/im_chat_members_add.go b/shortcuts/im/im_chat_members_add.go
index 2772ae403..39d9e7f33 100644
--- a/shortcuts/im/im_chat_members_add.go
+++ b/shortcuts/im/im_chat_members_add.go
@@ -177,9 +177,16 @@ var ImChatMembersAdd = common.Shortcut{
 	Command:     "+chat-members-add",
 	Description: "Add users and/or bots to a group chat; user/bot; batches --users (open_id) and --bots (app_id) into up to 2 API calls under best-effort semantics; returns a merged succeeded/invalid/not_existed/pending_approval ledger",
 	Risk:        "write",
-	Scopes:      []string{"im:chat", "im:chat.members:write_only"},
-	AuthTypes:   []string{"user", "bot"},
-	HasFormat:   true,
+	// Declare the narrowest scope the API accepts so tokens carrying only
+	// im:chat.members:write_only are honored (same rationale as
+	// +chat-members-list): chat.members.create's raw meta lists
+	// ["im:chat", "im:chat.members:write_only"] as OR alternatives, but the
+	// local scope precheck (internal/auth/scope.go's MissingScopes) treats
+	// every entry in Scopes as required (AND semantics), so listing both here
+	// would wrongly reject a token that only carries the narrow scope.
+	Scopes:    []string{"im:chat.members:write_only"},
+	AuthTypes: []string{"user", "bot"},
+	HasFormat: true,
 	Flags: []common.Flag{
 		{Name: "chat-id", Required: true, Desc: "chat ID to add members to (oc_xxx)"},
 		{Name: "users", Type: "string_slice", Desc: "user open_ids to invite (ou_xxx); comma-separated or repeat the flag; max 50"},
diff --git a/skills/lark-im/references/lark-im-chat-members-add.md b/skills/lark-im/references/lark-im-chat-members-add.md
index fed463bf1..47fbe48b3 100644
--- a/skills/lark-im/references/lark-im-chat-members-add.md
+++ b/skills/lark-im/references/lark-im-chat-members-add.md
@@ -68,4 +68,4 @@ This only applies when **both** `--users` and `--bots` were supplied (so both ca
 | `invalid --users value ...: must start with "ou_"` | Wrong ID type in `--users` | Use `open_id` (`ou_xxx`), not `union_id`/`user_id`/`app_id` |
 | `invalid --bots value ...: must start with "cli_"` | Wrong ID type in `--bots` | Use the app's `app_id` (`cli_xxx`) |
 | `--users exceeds the maximum of 50` / `--bots exceeds the maximum of 5` | Batch too large | Split into multiple calls |
-| Permission denied | Missing `im:chat` or `im:chat.members:write_only`, or caller not in the chat / not owner-admin when restricted | Bot: enable both scopes in the console. User: `lark-cli auth login --scope "im:chat,im:chat.members:write_only"`; confirm the caller is in the chat |
+| Permission denied | Missing `im:chat.members:write_only`, or caller not in the chat / not owner-admin when restricted | Bot: enable the scope in the console. User: `lark-cli auth login --scope "im:chat.members:write_only"`; confirm the caller is in the chat |