# Scopes

Every key has one scope. The scope decides what the key may do in the Apps it reaches.

| Scope | May read | May make changes | Shown as |
| --- | --- | --- | --- |
| `read` | yes | no | read key |
| `write` | yes | yes | full key |

## What a read key gets

- In the REST API, a request that makes a change is refused with `403` and the code
  `write_scope_required`. Nothing changes.
- In the MCP, the tools that make changes are not listed at all. The assistant sees only the
  tools that read.

To make changes, use a full key. A read key cannot be upgraded.

## What no scope allows

No key can delete anything or move money. There are no routes or tools for that.

## Apps

The scope works together with the Apps the key reaches. A request about an App that the key
does not reach is refused with `403` and the code `app_not_granted`, whatever the scope.

Each [MCP tool](/mcp/tools/) and each [REST route](/api/) says which scope it needs.