Scopes
Every key has one scope. The scope decides what the key may do in the Apps it reaches.
| Scope | May read | May make changes | Shown as |
|---|---|---|---|
read |
yes | no | read key |
write |
yes | yes | full key |
What a read key gets
Section titled “What a read key gets”- In the REST API, a request that makes a change is refused with
403and the codewrite_scope_required. Nothing changes. - In the MCP, the tools that make changes are not listed at all. The assistant sees only the tools that read.
To make changes, use a full key. A read key cannot be upgraded.
What no scope allows
Section titled “What no scope allows”No key can delete anything or move money. There are no routes or tools for that.
The scope works together with the Apps the key reaches. A request about an App that the key
does not reach is refused with 403 and the code app_not_granted, whatever the scope.
Each MCP tool and each REST route says which scope it needs.