All 15 scopes for API keys and AI connections: what each scope allows, what it is called in the dashboard and what no API key can do.
Scopes define what an API key may do. The same 15 scopes also apply to AI assistants you connect via MCP. Always choose only the scopes an application really needs.
Ground rules
- Every endpoint requires exactly one scope
- For API keys, write:X automatically includes read:X – the dashboard notes “write:X automatically includes read:X”
- If the scope is missing, the API responds with 403 insufficient_scope and names the scope it needs in details.required_scope
- Endpoints that are not enabled for API keys at all also respond with 403 insufficient_scope
- Owner and admin functions such as members, billing or managing domains cannot be reached with any scope
All scopes
In the “Create new API key” dialog you choose “Read” or “Write” for each area; the key list shows the scope names from the first column. The “Read · Pages” form appears on the consent page for AI apps and under “Connected apps”.
| Scope | For AI apps | Allows |
|---|---|---|
| read:pages | Read · Pages | List and read pages, read and validate the draft, list blocks, read SEO, list versions, fetch block types |
| write:pages | Write · Pages | Create and edit pages (including the handle), edit the draft, create, edit, delete and reorder blocks, edit SEO, visibility, publishing, restoring a version, invite links for private pages |
| read:links | Read · Links | List and read a page's links |
| write:links | Write · Links | Create, edit, delete and reorder links |
| read:assets | Read · Assets | List assets |
| write:assets | Write · Assets | Upload and delete assets, uploads for a page |
| read:forms | Read · Forms | Read forms, summary, list submissions and export them as CSV (export from Creator Pro) |
| write:forms | Write · Forms | Create, edit and delete forms |
| read:stats | Read · Statistics | Page and workspace statistics (summary, time series, comparison, links, widgets, conversions, top pages), push history and push usage |
| read:workspaces | Read · Workspaces | Read plan features, usage, member list and workspace settings, list domains, list and read templates, list and read callback secrets (without the plain-text secret) |
| write:workspaces | Write · Workspaces | Currently no endpoints beyond read:workspaces |
| read:donations | Read · Supporter payments | Totals of the workspace's supporter payments (payments via the “Support” block) |
| read:short_links | Read · Short Links | List and read short links |
| write:short_links | Write · Short Links | Create, edit and delete short links |
| write:templates | Write · Workspace templates | Create, edit and delete your own workspace templates (they are read with read:workspaces), see Custom templates |
Exactly which endpoints belong to which scope is shown in Endpoints by area.
What no API key can do
- Delete pages
- Create preview links for the draft
- Statistics breakdowns by device, country, referrer and UTM
- Send push notifications and manage push rules
- Connect or disconnect integrations
- Manage webhooks
- Add, verify, activate, deactivate or delete domains
- Manage members, invitations and roles, transfer ownership
- Change workspace settings, billing
- Create, edit, rotate or delete callback secrets
- The list of supporter payments, data access requests and anonymising form submissions
- Manage your profile, the pages you follow and the API keys themselves
You do these things in the dashboard.
Scopes for AI assistants
For an MCP connection you choose the same scopes on the consent page. There are two differences: first, a write permission there does not include the read permission – so grant both. Second, your role limits the choice: viewers only get read permissions (without forms and short links), editors get everything except “Write · Workspaces”, short links and workspace templates. More in Permissions, security and limits.
Recommended combinations
| Use case | Scopes |
|---|---|
| Reporting and dashboards | read:stats, read:pages |
| Sync links from a CMS or shop | write:links, read:pages |
| Maintain and publish pages automatically | write:pages, write:links |
| Campaign links from the CRM | write:short_links |
| Pass leads from forms to the CRM | read:forms |
| Roll out templates from a CI pipeline | write:templates, read:workspaces |
You might also find this useful
Nothing found?
Tell us what you need, and our support team will help you personally.