Every API key carries a set of scopes that decide which operations it can perform. Giving a key the narrowest scopes it needs limits the blast radius if it ever leaks. A read‑only key, for instance, can inspect flows and read run results but can never spend a credit.
Scopes
Permission presets
When you create a key you pick a preset. Internally it resolves to the scopes above.
Full
apps:read · apps:write · runs:read · runs:writeEverything: discover flows, create/publish flows, start runs, and read results.
Read-only
apps:read · runs:readInspect flows and read run results, but cannot start runs. A good default for keys that only poll.
Restricted
You chooseTick exactly the scopes the key should have.
Which scope each endpoint needs
A request to an endpoint whose scope the key doesn’t hold returns 403:
A common, safe setup for a browser publishable key is apps:read + runs:write + runs:read (so the page can fetch the flow’s inputs, start a run, and show the result) combined with a tight domain allowlist and a daily spend cap.
Editing a key’s permissions
You can change a key’s preset or scopes any time from Settings → API keys → Edit. The new permissions take effect immediately on the next request. A key’s type (secret/publishable) and owner (you/machine), however, are fixed at creation. 
