diff --git a/src/clients.js b/src/clients.js
index c2f80617c..bb921c4d3 100644
--- a/src/clients.js
+++ b/src/clients.js
@@ -113,9 +113,6 @@ function add(appId, type, redirectURI, scope, callback) {
     assert.strictEqual(typeof scope, 'string');
     assert.strictEqual(typeof callback, 'function');
 
-    // allow whitespace
-    scope = scope.split(',').map(function (s) { return s.trim(); }).join(',');
-
     var error = validateScope(scope);
     if (error) return callback(error);
 
diff --git a/src/routes/clients.js b/src/routes/clients.js
index 4acc2398a..1a063c7cc 100644
--- a/src/routes/clients.js
+++ b/src/routes/clients.js
@@ -28,6 +28,9 @@ function add(req, res, next) {
     if (typeof data.scope !== 'string' || !data.scope) return next(new HttpError(400, 'scope is required'));
     if (!validUrl.isWebUri(data.redirectURI)) return next(new HttpError(400, 'redirectURI must be a valid uri'));
 
+    // allow whitespace
+    data.scope = data.scope.split(',').map(function (s) { return s.trim(); }).join(',');
+
     clients.add(data.appId, clients.TYPE_EXTERNAL, data.redirectURI, data.scope, function (error, result) {
         if (error && error.reason === ClientsError.INVALID_SCOPE) return next(new HttpError(400, error.message));
         if (error && error.reason === ClientsError.BAD_FIELD) return next(new HttpError(400, error.message));