API key scope
An API key's scope is the specific set of actions or resources it is allowed to touch, as opposed to a key with full account access. Many services let you create a key scoped to, for example, read-only access, or access to a single project rather than every project on the account.
Why it matters
Scoping a key does not stop a leak from happening, but it puts a ceiling on what someone can do with it, which is usually the most practical protection available for a key that has to exist somewhere.
Should I always use the most limited scope available?
As a default, yes. Widen it only when something you are actually doing needs the extra access.
Can I change a key's scope after creating it?
Depends on the provider. Some let you edit permissions in place, others require generating a new key with the scope you want.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.