API keys

An API key is a bearer credential for a machine caller — a script, a cron job, an external service — that authenticates to the Table and Scripted REST surfaces as a dedicated, least-privilege service user.

Minting a key

You bind the key to a non-admin service user, give it a label, an optional expiry, and a scope — which tables and which verbs it may touch. The scope is chosen from real tables and the canonical verbs (read / create / write / delete), never typed by hand.

The key's scope intersects the service user's permissions — it never widens them — and keys cannot be minted for administrators. The plaintext token is shown once, at mint; only a hash is stored.

Scope selector

The same reusable scope control is used here and on the OAuth provider. "All tables / all verbs" or a specific pick; internal system tables are never offered as a grantable scope.