> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key scopes

> Platform API key permissions: API keys, billing, and team.

<Tip>
  The key returned by `POST /v1/platform/verify` has **empty scopes** = **ADMIN** access (everything) during onboarding. In production, create restricted keys via `POST /v1/platform/api-keys`.
</Tip>

## In short

* Each API key belongs to **one workspace**.
* Empty scopes on creation = **full access** (equivalent to ADMIN).
* **API keys** use `api_keys:read` and `api_keys:manage`
* **Billing** (plan, balance, cards, credit usage history) uses `billing:read` and `billing:manage`.
* **Team** (members and invites) uses `workspace:members:read` and `workspace:members:manage` .
* Messaging uses per-channel scopes documented in each API (WhatsApp, SMS, email…).

General guide: [API Keys](/en/guides/api-key/index).

***

## Scopes by area

| Area                               | Read                     | Manage                                                     |
| ---------------------------------- | ------------------------ | ---------------------------------------------------------- |
| API keys (`/v1/platform/api-keys`) | `api_keys:read`          | `api_keys:manage`                                          |
| Billing (plan, balance, cards)     | `billing:read`           | `billing:manage`                                           |
| Credit usage (`/credits/usage`)    | `billing:read`           | —                                                          |
| Members and invites                | `workspace:members:read` | `workspace:members:manage`                                 |
| Workspaces (`/v1/workspaces`)      | `workspace:read`         | `workspace:create`, `workspace:update`, `workspace:delete` |

With a login `sessionToken`, **OWNER/ADMIN** members can operate billing, keys, and team without scopes on the API key.

***

## How to send the key

```http theme={null}
Authorization: Bearer sk_live_xxxxx
```

Alternative: `x-api-key: sk_live_xxxxx`.

***

## API key routes (`/v1/platform/api-keys`)

| Method | Route                              | Scope             | Description                                         |
| ------ | ---------------------------------- | ----------------- | --------------------------------------------------- |
| GET    | `/v1/platform/api-keys`            | `api_keys:read`   | List keys (`?includeRevoked=true` includes revoked) |
| POST   | `/v1/platform/api-keys`            | `api_keys:manage` | Create key (`key` shown **once**)                   |
| GET    | `/v1/platform/api-keys/:id`        | `api_keys:read`   | Detail (no plaintext)                               |
| PATCH  | `/v1/platform/api-keys/:id`        | `api_keys:manage` | Name, scopes, limits, instances/domains/apps        |
| POST   | `/v1/platform/api-keys/:id/revoke` | `api_keys:manage` | Soft revoke (`revokedAt`)                           |