Scopes and permissions
Grant only the operations an integration needs. A key’s scope names do not create routes or tools that the current service does not expose.
| Scope | Current use |
|---|---|
keys:read |
MCP key inventory |
keys:write |
Create, rotate, and revoke keys, subject to ownership and delegation restrictions |
billing:read |
Protected billing reads; MCP wallet and plan limits |
billing:write |
Billing changes, including payment and subscription operations |
REST key metadata reads authenticate the owning account; they do not use the MCP tool’s keys:read check. Public pricing and public A2A discovery do not require a scope.
Delegation and app pins
Section titled “Delegation and app pins”A key managing another key needs keys:write and cannot act on scopes or app pins beyond its own grant. Pins are checked for ownership when keys are created. Account-level billing or key inventory should not be treated as app-specific merely because a key has a pin.
Wildcards are recognized by scope matching, but a narrow read permission is preferable for an account-inspection integration. Historical apps, edits, deploy, and other scope families do not establish current app-lifecycle API support.