Skip to main content
Every API key carries a set of scopes that decide which operations it can perform. Giving a key the narrowest scopes it needs limits the blast radius if it ever leaks. A read‑only key, for instance, can inspect flows and read run results but can never spend a credit.

​
Scopes

​
Permission presets

When you create a key you pick a preset. Internally it resolves to the scopes above.

Full

apps:read · apps:write · runs:read · runs:writeEverything: discover flows, create/publish flows, start runs, and read results.

Read-only

apps:read · runs:readInspect flows and read run results, but cannot start runs. A good default for keys that only poll.

Restricted

You chooseTick exactly the scopes the key should have.

​
Which scope each endpoint needs

A request to an endpoint whose scope the key doesn’t hold returns 403:
A common, safe setup for a browser publishable key is apps:read + runs:write + runs:read (so the page can fetch the flow’s inputs, start a run, and show the result) combined with a tight domain allowlist and a daily spend cap.

​
Editing a key’s permissions

You can change a key’s preset or scopes any time from Settings → API keys → Edit. The new permissions take effect immediately on the next request. A key’s type (secret/publishable) and owner (you/machine), however, are fixed at creation.
Last modified on August 29, 2026