The scopes
A key carries one or more scopes, picked when it is created in Developers. Each read has its own scope, and two scopes spend or commit (campaigns:write, plans:approve). One smaller write rides on a read scope: asking a creator for a price needs creators:read.
| Scope | What it allows | Writes |
|---|---|---|
inventory:read |
Network coverage for your audience | No |
audience:read |
Audience fit for a campaign or a profile | No |
campaigns:read |
Campaigns and where each stands | No |
evidence:read |
Proof of each paid post | No |
results:read |
Results of each paid post | No |
brain:read |
Your company context | No |
creators:read |
Approved creators on sale, by name, with price per format, and asking a creator for a price | No spend |
campaigns:write |
Start campaigns and change the creators on a plan, within its mandate | Yes |
plans:approve |
Sign a plan and get its payment link, within its mandate | Yes |
Writes need a mandate
A key with campaigns:write or plans:approve acts only inside the mandate the brand sets on it: the most a plan may total, a monthly cap, the channels, whether it may sign, an expiry, and the brand terms a person accepted for it. A write outside it is refused with 403 mandate_refused before anything is spent. See Authentication.
A missing scope
A REST call outside the key's scopes answers 403 forbidden and names the scope it needs. Over MCP, a tool whose scope the key lacks is not listed for that key, so an agent never sees a tool it cannot call.
Choosing scopes
Give each agent the fewest scopes it needs. A reporting agent needs campaigns:read, evidence:read and results:read. An agent that plans campaigns adds campaigns:write and the reads it searches with. Keep plans:approve on the key of the agent you trust to sign, with a mandate that caps what it may spend.