Skip to main content
Every endpoint requires one scope, and each endpoint’s page in this reference names it. An API key either has full access or holds a list of scopes.
  • A key with full access can call every endpoint your project has. Keys have full access unless you restrict them.
  • A restricted key can call only the endpoints whose scope is on its list.
Restricting keys limits the damage a leaked key can do. A key for a finance team that only downloads statements needs STATEMENTS_READ and nothing else, so it cannot issue cards or reveal card details.
Choose a key’s scopes in the dashboard when you create it, and change them there at any time. A change applies from the key’s next request.

​
When a key lacks a scope

A request from a key that does not hold the endpoint’s scope fails with 403 and code INSUFFICIENT_SCOPE. detail.requiredScope names the scope the key needs.