API Keys & Scopes
Every Credential carries one or more scopes — each scope gates one class of endpoint. A Credential with no scopes can authenticate but can't call anything.
Grant only the scopes your integration actually needs.
Scopes you can choose
| Scope | What it allows |
|---|---|
account.read |
Read your own identity via GET /me. Never entitlement-charged. |
feed.read |
Read the article feed via GET /feed. |
subscription.manage |
Read or replace which topics a Site is subscribed to (GET/PUT /subscriptions, GET /taxonomy). |
ai.usage.read |
Read your Site's own AI generation usage/budget status (GET /ai-usage). |
ai.images.read |
Read platform-wide AI image generation status (GET /ai-images). |
account.manage |
Manage your own Customer/Sites/Credentials programmatically (the /api/v1/account/* surface). |
billing.manage |
Start checkout, view, or cancel your own Site's subscription (/api/v1/billing/*). |
seo.profile.manage |
Read or replace your Site's SEO personalization profile (GET/PUT /api/v1/seo-profile). |
Scopes you will never see offered
FeedCentral also has a small number of platform-operator scopes governing internal operator surfaces — never anything a customer Credential can hold. They are not offered anywhere in the dashboard's Credential-creation form, and the server rejects any attempt to request one even if posted directly.
Choosing scopes
A Credential used only to power a read-only WordPress feed sync typically needs just feed.read
(plus subscription.manage if the same Credential also manages topic subscriptions). Broader
scopes like account.manage or billing.manage are for a Credential that will also manage the
Site/Customer or billing programmatically — most integrations don't need them.
See Authentication for how to create, revoke, and rotate a Credential.