> ## Documentation Index
> Fetch the complete documentation index at: https://www.voiceflow.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and scopes

> A valid credential identifies who is making a request. Authorization then checks which resources and actions that identity can access.

## How access is determined

A valid credential identifies who is making a request. Authorization then checks which resources and actions that identity can access. The presence of a key alone does not authorize every endpoint.

## Access controls

| Control | Personal key | Service key |
| --- | --- | --- |
| Identity | Your user account | A separate service-account identity |
| Resource selection | Selected resources further restrict your account’s access when scoped keys are available | Selected workspaces and projects within the service account’s organization |
| Action permissions | Must satisfy the key’s action scopes and your account’s permissions | Must satisfy the selected action scopes and service-account policy |
| Expiry | Required; up to 365 days | Expiring or Never |
| Management | Your personal-key settings | Organization-management permission required |
| Full key visibility | Once, at creation | Once, at creation |

### Resource access and actions are separate
Selecting a project does not grant every action on it. A key may be able to read a function but not execute it. For direct tool execution, schema discovery requires the corresponding read permission and execution requires execute permission. See [tool execution](/docs/developers/tools/execute).

### Existing personal keys
Older keys without explicit scopes retain access through the user’s account. New scopes do not retroactively narrow an existing key. Create and verify a replacement when you need a different access boundary.

### OAuth for MCP
The supported MCP OAuth flow requests `universal.workspace.read` and `universal.workspace.write`. These are different from the resource/action selections on personal and service keys. Do not copy these two scope names into a key configuration as a substitute for selecting its permissions.

### Settings management
Personal- and service-key management requires a signed-in browser session. A key that can make API requests is not a supported mechanism for issuing more keys.

## Related setup

[Personal keys](/docs/developers/authentication/personal-keys) · [Service keys](/docs/developers/authentication/service-keys) · [MCP authentication](/docs/mcp/authentication)