Requesting scopes

Request the minimum endpoint permissions

Read the identity, credential and scope requirements in API Reference. GET /v1/users/me requires USER identity and user:profile:read; asset upload requires creative:write.

1. Register allowed scopes on the application's OAuth client.
2. Request space-separated scopes at the accounts /oauth2/authorize endpoint, with S256 PKCE and state validation.
3. Check the scopes actually returned in the token response. Requested permissions are not proof of granted permissions.
4. Start a new user authorization when adding permissions; refreshing a token does not expand authorization.

Select API Key permissions during creation. Credentials, identity and scope must each satisfy the target endpoint.

See user authorization and scope catalog.