# API Key Scopes

Sheetgo API keys let apps, scripts, and AI agents act on your Sheetgo account.
By default a key can do **everything you can** — read, edit, run, and delete any
workflow, automation, form, and more.

**Scopes** let you narrow that down. You can limit a key to certain **actions**
(view only, or edit, or delete) and to certain **items** (all of your workflows,
or only a specific few). This is useful when you hand a key to an **AI agent or
script** that should only read data, an **integration** that should touch only
one or two workflows, or a **partner** who should have limited access.

> **Scopes only limit the key — not you.** Restricting a key never changes what
> you can do when you log in to Sheetgo yourself; it only limits requests made
> with that key.

## The two things a scope controls

A scope combines **what actions** are allowed with **which items** they apply to.

### Actions

| Action | What it allows |
|--------|----------------|
| **View** (read) | See and list items — read a workflow, list automations, view a form or schedule. |
| **Edit** (write) | Create, change, and **run** items — edit a workflow, **trigger a run**, set a schedule, submit a form. |
| **Delete** | Remove items — archive/delete a workflow, delete a form, remove a trigger. |
| **Full** | All of the above. |

> **Running a workflow counts as "Edit", not "View."** A View-only key cannot
> start runs — give it Edit if it needs to.

### Items

For each action you can choose **all items** of that type (all workflows, all
automations, …) or **only specific items** you pick. You can also apply a scope
to **everything at once** (all resource types) — for example, "View everything."

**Item types you can scope:** workflows, automations, forms, triggers
(schedules), webhooks, Outlook, and API destinations.

## Setting scopes in your Account

1. Go to **Account → Services and account → Sheetgo API**.
2. **Create a new key**, or open an existing key to **edit** it.
3. Choose the access level:
   - **Full access** *(default)* — the key can do everything.
   - **All items, limited actions** — e.g. *View only* across everything.
   - **Custom** — pick actions per item type, and optionally restrict each to
     specific items.
4. **Save.** When creating a key, copy it **immediately** — it is shown only
   once. When editing, changes take effect right away; **you don't need to
   regenerate the key** — the same key keeps working with its new limits.

## Examples

- **Read-only monitoring key** — *View → All items.* Lists and reads everything;
  cannot edit, run, or delete.
- **Run/edit only two workflows** — *Workflows → Edit → "Monthly Report",
  "Sales Sync".* Can run and edit those two, nothing else.
- **Read everything, edit one** — *View → All items* **plus** *Workflows → Edit
  → "Client Import".* A common "safe agent" setup.
- **Partner access to one workflow** — *Workflows → Full → "Partner Feed".* View,
  edit, run, and delete that one workflow only.
- **No restriction (default)** — *Full access.*

## Good to know

- **Restricting to specific items means the key can't create new ones.** Limiting
  *Edit* to a specific list lets the key change those items but **not create
  brand-new ones**. Give *Edit → All items* to allow creation.
- **Forms and schedules follow their workflow.** A form or trigger is reachable
  only if the key can also **view its workflow**.
- **Lists respect the scope.** A key limited to specific workflows sees only those
  when it lists workflows.
- **Keep keys secret.** A key is shown only once; if it leaks, delete it and
  create a new one. Scopes reduce the damage a leaked key can do but don't replace
  keeping it safe.
- **Changing a scope doesn't rotate the key** — editing limits keeps the same key
  string working.


---

More: start page https://dev-api.sheetgo.com/rest/reference.md, everything in one file https://dev-api.sheetgo.com/rest/llms-full.txt, OpenAPI https://dev-api.sheetgo.com/rest/openapi.json.