# Scopes

> Give each StrideHQ API key only the scopes it needs.

Give each key only the scopes it needs. A key that only reads data should only have `read`.

| Scope                  | Lets the key                                                         |
| ---------------------- | -------------------------------------------------------------------- |
| `read`                 | List and get creators, invoices, POs, payment runs and payments      |
| `creators:write`       | Create and update creators                                           |
| `invoices:write`       | Submit and update invoices                                           |
| `payment_runs:prepare` | Prepare and withdraw payment runs                                    |
| `webhooks:manage`      | Create, update, delete and test webhook endpoints, and resend events |

No scope can approve, fund or release a payment run, and no scope can add or change bank details. A person always does those in StrideHQ.

A request without the right scope gets a `403` with the type `permission` and the code `missing_scope`, naming the scope it needs.