Security
Permissions
Each token only does what was checked when it was created.
When creating a token, you choose what it can do. Grant the minimum your system needs: a bot that only reads does not need to generate keys.
| Permission | What it allows | Endpoints |
|---|---|---|
View catalogproducts:read | Mods available for resale and the price of each one in credits. | GET/products |
View balancecredits:read | Current balance and credit statement. | GET/credits |
View keyskeys:read | Your keys: status, HWID and time remaining. | GET/keys |
Generate keyskeys:generate | Creates new keys. Deducts credits from your balance. | POST/keys |
Reset HWIDkeys:reset-hwid | Frees a key to be used on another computer. Costs no credits. |
The Who am I endpoint works with any token and shows its permissions in auth.scopes.
When a permission is missing
The endpoint answers 403, and errors.required_scope says which permission is missing. Create a token with it in the panel — the permissions of an existing token cannot be changed.
What no token can do
Creating other tokens, configuring webhooks and buying credits are panel-only. A token, even with every permission, cannot reach them. If a token leaks, the damage is limited to what it can do.
Common combinations
| System | Permissions |
|---|---|
| Store that sells and delivers the key | View catalog, Generate keys |
| Support bot | View keys, Reset HWID |
| Finance dashboard | View balance |