API Key Scopes
The complete list of scopes an Aura API key can carry, and what each scope grants.
API Key Scopes
Aura API keys support 3 scopes that gate access to the Partner API. A key carries one or more scopes; each request enforces the required scope per route.
Scopes are assigned at key-creation time in Settings → API Keys → Create. Once a key is issued, its scopes cannot be changed — to widen or narrow access, create a new key and revoke the old one.
Available scopes
| Scope | What it grants |
|---|---|
read | Read-only access to all GET endpoints (leads, calls, booking links, products, payments, team, analytics, webhooks). |
write | Write access to POST, PATCH, and DELETE endpoints (create leads, update calls, manage payments). Does NOT include webhook subscription management. |
admin | Full access including webhook subscription CRUD and secret rotation. Reserve for trusted server-to-server integrations. |
Key environments
API keys are also tagged with an environment to keep test traffic separate from live traffic.
| Environment | Description |
|---|---|
live | Production keys with the prefix aura_pk_live_. Issued from the live dashboard; access real partner data. |
test | Sandbox keys with the prefix aura_pk_test_. Issued from the test dashboard; access test-mode data only (where applicable). |
Naming constraints
API key names are visible in the dashboard list and in audit logs. They must:
- Be 100 characters or fewer
- Match the pattern
/^[a-zA-Z0-9\s\-_()]+$/(letters, numbers, spaces, hyphens, underscores, parentheses)
Format
Every Aura API key has this shape:
aura_pk_<environment>_<random>Examples: aura_pk_live_AbC1234..., aura_pk_test_AbC1234.... The full key is shown ONCE at creation time — store it immediately in your secret manager.
Related
- Authentication — how to use a key in requests
- Settings → API Keys — creating and managing keys