Skip to main content
Each scope is a door on your key: app, device registration, send, or read, open only what you need.
Each scope unlocks one type of Push operation. Use only what your integration needs.

​
How to send the key

Recommended
Alternative
Each API Key belongs to one workspace. You cannot access another workspace with the same key.

​
Common combinations

Send only

push:send

Send and query

push:send, push:read

Full Web setup

push:apps:manage, push:devices:register, push:send, push:read

Register devices only

push:devices:register
An empty scope list on creation = ADMIN access. Always restrict in production.

​
Available scopes

List and query Push Apps in the workspace.
Create, update (VAPID, FCM, APNs as product evolves), and delete Push Apps.
Register a device or subscription. Also used to remove a device.
Send immediate or scheduled notifications to up to 100 device IDs per request.
  • List and query sends
  • List and query devices
  • Cancel scheduled push (SCHEDULED status)

​
Per-app limit

If the key has configured pushAppIds, it can only send to devices from those apps. Device from another app → 403 (PUSH_APP_NOT_ALLOWED). Empty list = any app in the workspace.

​
Common errors

Check Authorization: Bearer sk_... and that the key wasn’t deleted in the dashboard.
Check operation scope, pushAppIds on the key, and allowed origin on the app (ORIGIN_NOT_ALLOWED on public registration).
Send requires credits (PLAN_LIMIT_CREDITS). Scheduling depends on plan (PLAN_LIMIT_SCHEDULING).

​
Next steps