Reference
API-key scopes
Exactly what each key can do.
API keys carry scopes that gate every call. The SDK creates keys with the default scope set;
admin keys add management scopes. (dev or * on a key bypasses scope checks — local
development only.)
19Default scopeseverything an agent integration needs
+11Admin additionskey, workspace, and approval management
403On a missing scopecode: api_key_scope_missing
Exact lists from api-key-scopes.ts (defaultSdkApiKeyScopes / adminSdkApiKeyScopes).
Default SDK key (19 scopes)
| Scope | Gates |
|---|---|
providers:read / providers:manage | View the catalog / change project provider enablement. |
toolkits:read / toolkits:manage | List toolkits / enable-disable toolkits. |
sessions:create / sessions:read | Create / read sessions. |
tools:search | Tool discovery search. |
tools:schemas | Fetch tool schemas. |
tools:execute | Execute tools, batches, and workbench runs. |
connections:read / connections:manage | Read / create, refresh, delete connected accounts. |
auth_configs:read | Read your provider auth configs. |
triggers:read / triggers:manage | Read / create trigger subscriptions. |
artifacts:read | Read provider and workbench artifacts. |
logs:read | Read request, tool, trigger, webhook logs — and executions. |
webhooks:read | Read the project webhook endpoint. |
knowledge:read | Query knowledge packs and structured modules. |
billing:read | Read plans and usage. |
Admin additions (11 scopes)
| Scope | Gates |
|---|---|
sessions:manage | Update/close/fail any session. |
auth_configs:manage | Create/update/delete auth configs. |
webhooks:manage | Configure the webhook endpoint, rotate its secret. |
platform_approvals:read / platform_approvals:manage | Read / act on approval requests. |
api_keys:manage | Create and revoke API keys. |
workspaces:read / workspaces:manage | Read / manage dashboard workspaces. |
members:read / members:manage | Read / manage workspace members. |
billing:manage | Checkout, portal, plan changes. |
Headers
Authorization: Bearer <stacklink-api-key> # or:
x-stacklink-key: <stacklink-api-key>
x-stacklink-registration-key: <reg-key> # project registration / bootstrap onlyA missing scope returns 403 with code api_key_scope_missing — see
Errors.