API keys: scopes (contacts:write, campaigns:send) enforced per route #70

New issue

Open

opened 2026-10-26 10:45:56 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-26 10:45:56 -04:00

Owner

Follow-up to #29 (Phase 13.1, v0.15.1).

#29 asked for optional scopes per key (for example contacts:write and campaigns:send). v0.15.0 did not enforce them.

Plan

Optional scopes chosen at key creation; shown on the API Keys page.
Project-scoped routes declare the scope they need; keys without it get 403. Keys with no scopes keep current behaviour (documented).
Session (human) auth is unaffected.

Done when

e2e: a key missing a scope is refused; a key with it succeeds (#29 "scopes are enforced").

Follow-up to #29 (Phase 13.1, v0.15.1). #29 asked for optional scopes per key (for example `contacts:write` and `campaigns:send`). v0.15.0 did not enforce them. **Plan** - Optional scopes chosen at key creation; shown on the API Keys page. - Project-scoped routes declare the scope they need; keys without it get 403. Keys with no scopes keep current behaviour (documented). - Session (human) auth is unaffected. **Done when** - e2e: a key missing a scope is refused; a key with it succeeds (#29 "scopes are enforced").

vmanne-poc added this to the Phase 13.1: API key scopes & provider webhooks milestone

2026-10-26 10:45:56 -04:00

vmanne-poc added the

feature

security

labels

2026-10-26 10:45:56 -04:00

vmanne-poc referenced this issue

2026-10-26 10:46:13 -04:00

Project API keys #29