Skip to main content
Scopes constrain what an OAuth access token can do. A client can only request scopes inside its registered allowed_scopes allowlist, and the user granting consent can further narrow the set on the consent screen. Applies to OAuth only. API keys don’t use scopes — they’re bound to the tenant with all-or-nothing access inside their allowed_scopes.

​
OIDC core

​
Resource scopes

​
Composition

Scopes are space-separated in the token request:
The issued access token carries them in its scope claim. Server-side gate check is exact-match per route — requesting only campaigns:read and trying to POST /api/v1/campaigns returns a 403 { "detail": "missing scope campaigns:write" }.

​
Principle of least privilege

Partners are expected to request only the scopes they need. AppExchange and similar review processes will flag a listing that requests campaigns:write but never actually writes campaigns. Narrow the set to what your integration actually uses.

​
Future scopes

We version by adding new scopes (never changing the semantics of existing ones). When a new resource ships, its scopes appear here within the same release. Subscribe to the changelog to track additions.