Scopes
Give each key only the scopes it needs. A key that only reads data should only have read.
| Scope | Lets the key |
|---|---|
read | List and get creators, invoices, POs, payment runs and payments |
creators:write | Create and update creators |
invoices:write | Submit and update invoices |
payment_runs:prepare | Prepare and withdraw payment runs |
webhooks:manage | Create, update, delete and test webhook endpoints, and resend events |
No scope can approve, fund or release a payment run, and no scope can add or change bank details. A person always does those in StrideHQ.
A request without the right scope gets a 403 with the type permission and the code missing_scope, naming the scope it needs.