It just dawned on me... I have set my app to ask for permissions for custom_JSON operations, but I don't really need it -- at least not yet.
I'll update things tonight to no longer get scope for custom_json.
This doesn't really affect anything in terms of providing your posting-key to SteemConnect, but SC does (I believe) manage scope for posting authority.