> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# API Key Scopes

> Push channel permissions: apps, devices, send, and query.

<Tip>
  Each scope is a **door** on your key: app, device registration, send, or read, open only what you need.
</Tip>

Each **scope** unlocks one type of Push operation. Use only what your integration needs.

## How to send the key

**Recommended**

```http theme={null}
Authorization: Bearer sk_live_your_key_here
```

**Alternative**

```http theme={null}
x-api-key: sk_live_your_key_here
```

<Info>
  Each API Key belongs to **one** workspace. You cannot access another workspace with the same key.
</Info>

## Common combinations

<CardGroup cols={2}>
  <Card title="Send only" icon="paper-plane">
    `push:send`
  </Card>

  <Card title="Send and query" icon="magnifying-glass">
    `push:send`, `push:read`
  </Card>

  <Card title="Full Web setup" icon="globe">
    `push:apps:manage`, `push:devices:register`, `push:send`, `push:read`
  </Card>

  <Card title="Register devices only" icon="mobile">
    `push:devices:register`
  </Card>
</CardGroup>

<Warning>
  An **empty** scope list on creation = **ADMIN** access. Always restrict in production.
</Warning>

## Available scopes

<AccordionGroup>
  <Accordion title="push:apps:read">
    List and query Push Apps in the workspace.
  </Accordion>

  <Accordion title="push:apps:manage">
    Create, update (VAPID, FCM, APNs as product evolves), and delete Push Apps.
  </Accordion>

  <Accordion title="push:devices:register">
    Register a device or subscription. Also used to remove a device.
  </Accordion>

  <Accordion title="push:send">
    Send immediate or scheduled notifications to up to 100 device IDs per request.
  </Accordion>

  <Accordion title="push:read">
    * List and query sends
    * List and query devices
    * Cancel scheduled push (`SCHEDULED` status)
  </Accordion>
</AccordionGroup>

## Per-app limit

If the key has configured **`pushAppIds`**, it can only send to devices from those apps. Device from another app → **403** (`PUSH_APP_NOT_ALLOWED`).

Empty list = any app in the workspace.

## Common errors

<AccordionGroup>
  <Accordion title="401: missing, invalid, or revoked key">
    Check `Authorization: Bearer sk_...` and that the key wasn't deleted in the dashboard.
  </Accordion>

  <Accordion title="403: missing scope or app not allowed">
    Check operation scope, `pushAppIds` on the key, and allowed origin on the app (`ORIGIN_NOT_ALLOWED` on public registration).
  </Accordion>

  <Accordion title="402/403: credits or scheduling">
    Send requires credits (`PLAN_LIMIT_CREDITS`). Scheduling depends on plan (`PLAN_LIMIT_SCHEDULING`).
  </Accordion>
</AccordionGroup>

## Next steps

* [Quick Start](/en/push-api/como-funciona/quick-start)
* [Webhook events](/en/push-api/como-funciona/eventos-do-webhooks)
* [API Keys guide](/en/guides/api-key/index)