Public API
Scopes
Which scope an API key needs for each endpoint, and what API keys can never reach.
How scopes work
A scope is resource:action. The action is decided by the HTTP method:
| Method | Needs |
|---|---|
GET, HEAD | resource:read |
POST, PUT, PATCH, DELETE | resource:write |
write always includes read: a key with keys:write can list keys too. In the dashboard each resource is a None · Read · Write switch, with Read-only and Full access presets.
Resources
| Resource | Scopes | Reference |
|---|---|---|
| Keys | keys:read keys:write | Keys — create, list, update, bulk actions, refunds, sharing alerts, export, import. Bans & key holders — /api/keys/bans, /api/keys/discord-users. |
| Key folders | folders:read folders:write | Folders — /api/keys/folders |
| Key templates | key-templates:read key-templates:write | Key templates — /api/key-templates |
| Services | services:read services:write | Services — /api/services, including …/{id}/providers, …/{id}/stats and …/{id}/settings |
| Providers | providers:read providers:write | Providers — /api/providers, including checkpoint stats |
| Revenues | revenues:read revenues:write | Revenues — /api/revenues |
| Webhooks | webhooks:read webhooks:write | Store webhooks — /api/v1/webhooks |
| Obfuscation | obfuscation:read obfuscation:write | Obfuscation — /api/obfuscation |
| Analytics | analytics:read | Analytics — /api/analytics |
Every endpoint in the reference shows the exact scope it needs next to its path.
Never available to API keys
These areas only work from a signed-in dashboard session. An API key gets 403 here regardless of its scopes:
- Account: profile, password, 2FA, sessions, login alerts (
/api/me,/api/account-security). - Money: token balance, plans, redeem codes, referrals, reseller (
/api/tokens,/api/plans,/api/redeem,/api/referrals,/api/reseller). - Settings, notifications, AI chat.
- Service team: members, invites, ownership transfer, leaving a service.
- Discord bot setup and mass compensation.
- API keys themselves — a key can't create, list or revoke keys, so a leaked key can't escalate.
- Everything under
/api/admin.
Choosing scopes
| Integration | Scopes |
|---|---|
| Deliver keys from your own checkout | keys:write |
| Revoke keys when an order is refunded | keys:write |
| Discord bot: look up and ban key holders | keys:write |
| Read-only dashboard or stats widget | analytics:read, services:read |
| Re-upload the script from CI | obfuscation:write |
| Sync store webhooks from infrastructure-as-code | webhooks:write, services:read |
| Support bot: find a buyer and reset their HWID | keys:write |