Access Control
MCP Key Scopes
Control which SyncFlo tools your AI client can discover and execute using fine-grained API key scopes.
Scope Restrictions
API keys can be restricted to a set of scopes to limit access. Each tool in the MCP catalog maps to a corresponding REST operation and requires the same scope as that endpoint.
A key with no scopes has full owner-equivalent access (fully backward-compatible).
Any tool call made outside of the key's scopes will fail immediately with a
403 forbidden error.Recommended: Read-Only Preset
For safety, we highly recommend selecting the read-only preset when creating keys for third-party AI clients. This prevents the AI from mutating your account data while allowing full analytics and read capability:
leads:readconversations:readcampaigns:readorders:readcatalogue:readknowledge:readagents:readanalytics:readAvailable Scope Reference
| Scope | Grants |
|---|---|
leads:read | View leads |
leads:write | View, update, assign, create, delete leads |
conversations:read | View conversations and messages |
messages:send | View conversations + send messages |
campaigns:read | View campaigns |
campaigns:write | View + create/update/delete campaigns |
campaigns:send | View + queue/send campaigns |
orders:read | View orders |
orders:write | View + create/update orders |
catalogue:read | Search the product catalogue |
knowledge:read | View knowledge base sources |
knowledge:write | View + add to the knowledge base |
agents:read | View AI agents |
agents:write | View + update agents |
analytics:read | View analytics and usage |
ai:use | Use the AI simulation tool |