API Permissions
API permissions control what an authenticated caller can do. Using limited-scope API keys is an important safety measure for agent systems.
6 min•By Priygop Team•Updated 2026
Permission Scoping
- Use read-only API keys for agents that only need to retrieve data
- Create separate API keys for each agent with only the scopes it needs
- Rotate API keys regularly — if a key is compromised, a new one is quickly issued
- Never give an agent production credentials for development testing
- Use sandbox or test-mode credentials during development
- Audit which agents are using which API keys and review regularly
Scope Examples
Stripe API scopes:
- restricted key (read orders): can only view charges, cannot create or refund
- restricted key (read + create): can view and create charges, cannot refund
- full access key: can do everything including refunds and payouts
GitHub API scopes:
- repo:read: can read repository content
- repo:write: can create files and commits
- issues:write: can create and update issues
- admin:all: full administrative access
Rule: agents should always use the most restrictive scope that still allows them to complete their task.
Key Takeaways
- API permissions control what an authenticated caller can do.
- Use read-only API keys for agents that only need to retrieve data
- Create separate API keys for each agent with only the scopes it needs
- Rotate API keys regularly — if a key is compromised, a new one is quickly issued