> For the complete documentation index, see [llms.txt](https://docs.themochi.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.themochi.app/start-here/scopes.md).

# Choose permissions

A **scope** is a permission granted to an API key or OAuth connection. Request only the permissions needed for one integration. This limits the impact of a mistake or exposed credential.

| Scope               | What it allows                                                                             |
| ------------------- | ------------------------------------------------------------------------------------------ |
| `leads:read`        | Read lead lists, lead details, and basic lead intelligence                                 |
| `signals:read`      | Read signal lists and signal intelligence                                                  |
| `analytics:read`    | Read organization analytics                                                                |
| `bookings:read`     | Read bookings                                                                              |
| `revenue:read`      | Read revenue; requires an approved organization identity or a member with a permitted role |
| `config:read`       | Read configuration, connection status, and send policy                                     |
| `team:read`         | Read the team; requires an approved organization identity or a Creator or Manager member   |
| `leads:write`       | Change lead stage, archive state, contact details, assignment, or tags                     |
| `messages:send`     | Schedule approved follow-ups                                                               |
| `automations:write` | Create or run keyword automations and flows; restricted to permitted roles                 |
| `links:write`       | Create tracking links                                                                      |
| `config:write`      | Change prompt configuration; restricted to permitted roles                                 |
| `content:write`     | Create or change content and media                                                         |
| `connections:write` | Manage provider connections; organization-principal keys only                              |
| `team:write`        | Invite or deactivate team members; organization-principal keys only                        |

If you are making your first request, start with `leads:read`. Add another scope only when a specific task needs it.

Having a scope does not bypass organization ownership, member-role rules, provider approval, feature availability, validation, or messaging safety rules. If a key lacks a required scope, the API returns `403`.

Use a separate, narrowly scoped key for an unrelated integration instead of adding more power to an existing key.