Scopes

A scope defines what the token can do. Ask for the minimum — the user sees the full list before approving.

How scopes work in OAuth

You declare scopes at two points:

Client registration — app defaults (dashboard or POST /oauth/register)
Authorization — what you request for that login (scope on /oauth/authorize)

The token only works on endpoints the scope allows — same as API keys.

Channel	Guide
Email	Email scopes
WhatsApp	WhatsApp scopes
SMS	SMS scopes
Contacts	Contacts scopes
Webhooks	`webhooks:read`, `webhooks:manage` — Webhooks
Logs	`logs:read` — API logs
Workspaces	`workspace:read`, … — Workspaces

Use case	Scopes
Transactional email	`email:send`
CRM + sends	`contacts:read`, `contacts:create`, `whatsapp:send`
Integration audit	`logs:read`

Multiple scopes: scope=email:send%20contacts:read.