> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onlyfanskit.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Scopes

> What each API key is allowed to do.

Every API key carries a set of scopes. A key can only ever be minted with a
subset of the scopes its creator holds, so you can build least-privilege keys
for automations.

## Runtime scopes

| Scope            | Grants                                          |
| ---------------- | ----------------------------------------------- |
| `accounts:read`  | List and fetch your own connected accounts.     |
| `accounts:write` | Connect and disconnect accounts.                |
| `sdk:call`       | Invoke any SDK method against an owned account. |
| `webhooks:read`  | Read webhook configuration.                     |
| `webhooks:write` | Set, delete, and test webhooks.                 |

## Self-service scopes

| Scope        | Grants                                         |
| ------------ | ---------------------------------------------- |
| `me:read`    | Read your org and list your keys.              |
| `me:write`   | Update org contact info, mint and revoke keys. |
| `usage:read` | Read usage counters and rate-limit windows.    |

## Default set

Customer keys without an explicit scope list get the everyday set:

```
accounts:read  accounts:write  sdk:call
webhooks:read  webhooks:write
me:read        me:write        usage:read
```

Mint a narrower key by passing `scopes` when creating it:

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -X POST https://api.onlyfanskit.dev/v1/me/keys \
  -H "Authorization: Bearer $OFK_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "label": "read-only metrics", "scopes": ["accounts:read", "sdk:call", "usage:read"] }'
```

<Note>
  Admin scopes (`admin:*`) are only ever granted on internal tokens, never on
  customer keys.
</Note>

## Checking your scopes

`GET /v1/me` returns the scopes on the calling key. A call that needs a scope
you don't hold returns `403` with a problem body naming the missing scope.