Scopes
Map each workflow to the minimum required scope
Public API keys should be scoped narrowly. Give read-only access where possible and expand to write scopes only when the automation needs to mutate content or storage state.
posts:read
Read posts
List posts and fetch individual post details.
posts:write
Write posts
Create, update, delete, and publish posts.
assets:read
Read assets
List organization assets and inspect reusable media metadata.
assets:write
Write assets and media
Create asset records and sign direct-upload media operations.
integrations:read
Read integrations
List connected social accounts available to the organization.