Glossary
API key scopes
Also called: API scopes · API permissions · Scoped API key
API key scopes are the permissions attached to an API key that limit which actions and data a program using that key can reach.
An API key lets a program act on an account without a person signing in. Scopes keep the damage small if a key leaks: a key that only reads reports can’t send messages or remove members.
Common practice is the least privilege each integration needs, one key per integration, an expiry date, and a secret shown only once so it goes straight into a secret store. A leaked key should be revoked at once.
How Risti does it
In Risti, only owners create API keys, in Settings › Developers › Create key: a name, “What it can do” (the scopes) and Expires (Never, 30 days, 90 days or a year). The key, which starts with rk_live_, is shown once.
Scopes include Read conversations, Send replies, Write internal notes, Assign conversations, Change conversation status, Manage members, Read the activity log and Manage knowledge. A key’s scopes are always a subset of its creator’s role and narrow if that role changes. Events going out are sent by webhooks.