An API key is either full access or restricted. A full-access key can call every endpoint available to your account. A restricted key carries an explicit list of permissions, and a request to an endpoint it was not granted is refused.

Keys are created and edited on the EukaPay dashboard, under Settings → Integrations. Keys created before permissions were introduced are full access and keep working unchanged.

Permissions

A permission is written resource:action. The actions are read and write, and write implies read — a key holding invoices:write can also read invoices, so you do not need to grant both.

Permission	Grants
`invoices`	Invoices
`templates`	Checkouts (templates)
`customers`	Customers
`subscriptions`	Subscriptions
`transactions`	Transactions — read only
`withdrawals`	Payouts — read only
`webhook_events`	Webhook events — read only
`balance`	Balance
`crypto_payouts`	Crypto payouts
`refunds`	Refund requests
`trades`	OTC trades

Resources marked read only are not writable through the API, so only <resource>:read exists for them.

Accounts with additional features enabled also see the permissions for those features. The permission table shown when you create a key is the authoritative list for your account.

Permissions control which endpoints a key may call. They do not enable a feature your account does not have: an endpoint for a feature that is not enabled on your account is refused whatever permissions the key holds.

Presets

The dashboard offers presets as a starting point. A preset only fills in the permission table — a key created from one is indistinguishable from the same permissions picked by hand, and you can adjust the selection afterwards.

Preset	Permissions
Full access	Every endpoint. Not a permission list — the key is full access.
Read only	`read` on every resource.
Payments	`write` on invoices, checkouts, customers and subscriptions, plus `read` on transactions and webhook events.
Payouts	`write` on balance and crypto payouts, plus `read` on transactions and webhook events.
Custom	Whatever you select.

Enabling a new feature on your account later does not add permissions to keys that already exist. Edit the key to grant them.

When a Key Lacks a Permission

A request made with a restricted key that does not hold the required permission is refused with 403 and the error code insufficient_scope:

{
  "statusCode": 403,
  "code": "insufficient_scope",
  "message": "This API key does not have the invoices:write permission.",
  "type": "api_error"
}

The message names the permission that was missing. Retrying does not help — grant the permission to the key on the dashboard, or use a key that holds it.

Endpoints that are not available to restricted keys at all return the same insufficient_scope code with the message This endpoint is not available to a restricted API key. Use a full-access key for those.

insufficient_scope means the key was accepted and does not hold the permission. A request whose key is missing, unrecognised or deleted is also refused with 403, but carries no code — read the code field to tell the two apart.

Last Used

Each key records when it was last used to make a request, shown as Last Used on the dashboard. A key that has never been used reads never. The timestamp is updated at most once every five minutes, so it is a reliable way to find keys you can safely delete rather than a precise record of every call.