> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sideshift.app/llms.txt
> Use this file to discover all available pages before exploring further.
# Scopes and token security
> Every capability scope a client can request, which ones are sensitive, and how to verify an access token.
A SideShift access token carries exactly the scopes a company consented to, and nothing
else. Scope enforcement is identical for every scope: a request without the required scope
fails with `insufficient_scope` rather than silently returning less data.
Ask for the narrowest set that does the job. Consent screens show every scope you request,
and a request for money-moving access is the most common reason a company declines.
## The scope catalog
SideShift defines **65** capability scopes. **63** of them can be
requested by a third-party client and consented to by a company;
`offline_access` is a protocol signal rather than a capability, and 1 scope
(`performance:read`) is grantable only to SideShift's own organisation.
**11** scopes are marked sensitive: they move money or change company
configuration, the consent screen highlights them, and their tools are rejected for
sandbox tokens. Request only what your integration needs.
| Scope | Grants | Sensitive |
| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- |
| `campaigns:read` | Read your campaigns and payment structures. | No |
| `campaigns:write` | Create, update, and archive campaigns and payment structures. | No |
| `applications:read` | Read creator applications to your campaigns. | No |
| `applications:write` | Approve, reject, and update creator applications. | No |
| `creators:read` | Read creator profiles and collections. | No |
| `creators:write` | Invite creators to campaigns and update creator collections. | No |
| `contracts:read` | Read your creator contracts. | No |
| `contracts:write` | Create, accept, and cancel contracts. | No |
| `posts:read` | Read posts and their metrics. | No |
| `posts:write` | Set post approval status, mark/clear deletion, and manage analytics tags. | No |
| `analytics:read` | Read analytics and performance data. | No |
| `payouts:read` | Read payouts, stats, and payout history. | No |
| `payouts:write` | Execute, quick-pay, and release payouts to creators — this moves money. | **Yes** |
| `invoices:read` | Read your invoices. | No |
| `invoices:write` | Create, send, and void invoices. | **Yes** |
| `messages:read` | Read conversations and messages. | No |
| `messages:write` | Send messages on your behalf. | No |
| `settings:read` | Read company settings. | No |
| `settings:write` | Change company settings. | **Yes** |
| `disputes:read` | Read creator-payment disputes and their evidence. | No |
| `disputes:write` | Resolve disputes and submit counter-evidence — this can move money. | **Yes** |
| `discover:read` | Read your Discover marketplace offer/listing. | No |
| `discover:write` | Publish, update, or remove your Discover marketplace offer. | No |
| `agencies:read` | Read agency dashboard, client lists, creator details, and payment receipts | No |
| `agencies:write` | Update agency program/contract/client notes, program status, and client archive status | No |
| `applicants:read` | Read access to applicants, including filtered lists, counts, and export | No |
| `applicants:write` | Write access to update applicant status, bookmarks, and resolve support channels | No |
| `video-submissions:read` | Read creator video submissions for your campaigns, including review status. | No |
| `video-submissions:write` | Approve, reject, or request revisions on video submissions, and delete submissions. | No |
| `booking:read` | Read creator booking settings, booking intents, and service types. | No |
| `booking:write` | Create and modify bookings, send booking requirements, and other write operations | No |
| `brand-content-pages:read` | List and view brand content pages (public published pages visible to all, drafts visible to writers only) | No |
| `brand-content-pages:write` | Create, update, and manage brand content pages (create drafts, publish, manage public share tokens) | No |
| `brand-livestream:read` | Read active livestreams, recordings, and settings for brand livestreams. | No |
| `brand-livestream:write` | Start/end livestreams, mint viewer tokens, rotate stream keys, and manage egress. | No |
| `brand-livestream:settings` | Update chat and moderation settings for brand livestreams. | No |
| `brand-verification:read` | Read access to brand verification status and request history | No |
| `brand-verification:write` | Create brand verification requests and prepare document uploads | No |
| `verification:read` | Read your identity verification status, profile, and required actions. | No |
| `brand-performance:read` | Read your own campaign spend/delivery health and creator-match shortlists. Requires SideShift to enable the Performance API for your company (manual provisioning). | No |
| `agency-performance:read` | Read performance data for every client brand in your agency's subtree — per-client health, scorecards, creator relationships, and a portfolio rollup. Agency accounts only; requires SideShift to enable the Performance API. | No |
| `community-courses:read` | Read-only access to community course content and metadata | No |
| `community-courses:write` | Create, update, and delete community courses (educational content management) | No |
| `community-offers:read` | Read community offers, promo codes, and membership data | No |
| `community-offers:write` | Create, update, and delete community offers, promo codes, and Discord integration settings | No |
| `community-offers:checkout` | Create checkout sessions for community offer purchases (involves payment processing) | **Yes** |
| `community-offers:membership` | Link and resolve community offer memberships from purchases (involves payment processing) | **Yes** |
| `integrations:read` | Read Slack integrations, channels, templates, and configuration | No |
| `integrations:write` | Create, update, and delete Slack integrations, channels, templates, and workflows | No |
| `jobs:write` | Create new jobs and update existing jobs, including changing posting status, reposts, and job management. Costs job posting credits for new jobs. | No |
| `jobs:read` | List and read job data, including duplicate target companies. Read-only access to job details. | No |
| `recruit:read` | Search recruit students and view bookmarked recruits | No |
| `recruit:write` | Send recruit invites, manage bookmarks, and mint action tokens | No |
| `team:read` | Read access to team members list and company invites. Allows viewing member details, permissions, and pending invitations. | No |
| `team:write` | Write access to add, remove, and update team members, and create/send team invitations. | **Yes** |
| `quick-pay:read` | Read Quick-Pay drafts, schedules, templates, approvals, pending payments, and recent recipients. | No |
| `quick-pay:write` | Create/update/send Quick-Pay drafts, schedules, templates, and approvals — sending moves money to creators. | **Yes** |
| `wallet:read` | Read your company/agency wallet balance, summary, and ledger. | No |
| `wallet:write` | Top up (Stripe/bank transfer), reconcile, transfer balance, and record ledger entries — this moves money. | **Yes** |
| `billing:read` | Read subscription status, payment methods, bank-account status, and upgrade previews. | No |
| `billing:write` | Manage subscription, payment methods, and bank accounts — this changes what you are charged. | **Yes** |
| `agency-billing:read` | Read your agency billing configuration. | No |
| `agency-billing:write` | Update agency billing info, generate subscription links, toggle separate subs, and assign free clients — this moves money. | **Yes** |
## Sensitive scopes
Sensitive scopes are not enforced differently, but they carry extra guards further down:
* Their tools and endpoints are **rejected for sandbox and test grants**, so a test
integration cannot move money or send outbound communication.
* The MCP server can disable them globally with `MCP_SAFE_MODE`.
* Money-moving writes require an `Idempotency-Key`, so a retried call cannot double-charge.
See [idempotency](/platform/errors#6-idempotency).
## Verifying an access token
Access tokens are JWTs signed by SideShift. A resource server can verify one without calling
SideShift on every request:
`GET /api/oauth/v1/jwks` returns the public JWKS. Cache it and refresh on an unknown
`kid`, which is what a key rotation looks like from outside.
Verify the signature against the matching `kid`, then check `iss` matches the issuer from
discovery, `aud` matches `https://app.sideshift.app/api/oauth/v1`, and `exp` is in the
future.
The token's scopes are the ones consented to. Anything outside them must fail rather than
degrade.
Verification is stateless up to this point. SideShift additionally applies runtime checks on
its own side that a third party cannot replicate, including whether the grant has since been
revoked and whether the company's subscription is still active, so a structurally valid token
can still be rejected with `401` or `402`.
Do not treat a token as valid purely because it parses. A revoked grant produces a token
that still verifies cryptographically until it expires.
## Key rotation
Signing keys rotate. Clients that cache the JWKS should key their cache on `kid` and refetch
when they see one they do not recognise, rather than on a fixed timer. Both discovery
documents and the JWKS endpoint are public and unauthenticated.
## Managing clients and grants from the dashboard
Registration does not have to go through `POST /register`. **Settings → OAuth & MCP** lets
owners, admins, and members with the `manageApiKeys` permission:
* Register a client for their own company automation, or an app other SideShift companies can
connect to
* Review every third-party app the company has connected, with granted scopes, and revoke any
connection
* Browse this scope catalog interactively
* Run read-only requests against the API without writing any code
That is the quickest route for a single-company integration. Dynamic client registration
remains the right path for a distributed app.