Reference
API-key scopes
Exactly what each key can do.
API keys carry scopes that gate every call. The SDK creates keys with the default scope set;
admin keys add management scopes. (dev or * on a key bypasses scope checks — local
development only.)
Exact lists from api-key-scopes.ts (defaultSdkApiKeyScopes / adminSdkApiKeyScopes).
Default SDK key
| Scope | Gates |
|---|---|
bots:read / bots:run | Read / run permitted Bots. |
workflows:read / workflows:run | Read / run permitted workflows. |
memory:read / memory:write | Recall / save within authorized Memory scope. |
providers:read / providers:manage | View the catalog / change project provider enablement. |
toolkits:read / toolkits:manage | List toolkits / enable-disable toolkits. |
sessions:create / sessions:read | Create / read sessions. |
tools:search | Tool discovery search. |
tools:schemas | Fetch tool schemas. |
tools:execute | Execute tools, batches, and workbench runs. |
connections:read / connections:manage | Read / create, refresh, delete connected accounts. |
auth_configs:read | Read your provider auth configs. |
triggers:read / triggers:manage | Read / create trigger subscriptions. |
artifacts:read | Read provider and workbench artifacts. |
logs:read | Read request, tool, trigger, webhook logs — and executions. |
webhooks:read | Read the project webhook endpoint. |
knowledge:read | Query knowledge packs and structured modules. |
billing:read | Read plans and usage. |
Admin additions
| Scope | Gates |
|---|---|
bots:manage / workflows:manage | Author and publish Bots / workflows. |
knowledge:manage | Manage Knowledge. |
memory:manage / memory:export / memory:erase | Manage, export or erase authorized Memory. |
sessions:manage | Update/close/fail any session. |
auth_configs:manage | Create/update/delete auth configs. |
webhooks:manage | Configure the webhook endpoint, rotate its secret. |
platform_approvals:read / platform_approvals:manage | Read / act on approval requests. |
api_keys:manage | Create and revoke API keys. |
workspaces:read / workspaces:manage | Read / manage dashboard workspaces. |
members:read / members:manage | Read / manage workspace members. |
billing:manage | Checkout, portal, plan changes. |
Workflows
| Scope | Allows |
|---|---|
workflows:read | Read permitted definitions, runs and history |
workflows:run | Start permitted runs and request authorized recovery |
workflows:manage | Create/edit/publish and manage triggers |
Read/run are in the default SDK set; authoring requires the explicit management scope. Session and actual step permissions still apply. Workflow permissions · Complete SDK setup
Headers
Authorization: Bearer <stacklink-api-key> # or:
x-stacklink-key: <stacklink-api-key>
x-stacklink-registration-key: <reg-key> # project registration / bootstrap onlyA missing scope returns 403 with code api_key_scope_missing — see
Errors.