Scopes and presets

Every API key and connected app has scopes (what it may do) and an account scope (where it may do it). A tool needs one scope; a call outside the key’s scopes or accounts answers SCOPE_NOT_GRANTED or ACCOUNT_NOT_PERMITTED.

Scopes

accounts:read, accounts:manage (profiles, connect links, moving and pausing accounts), mail:read, mail:draft, mail:send, mail:organize (move, archive, trash, read and flag state, labels, folders), calendar:read, calendar:write, calendar:respond, approvals:read, usage:read.

Presets

The key dialog and the consent screen offer four presets:

Preset	Scopes	Sends need approval
Read only	accounts:read mail:read calendar:read usage:read	Cannot send
Assistant (the default)	everything except accounts:manage	Yes
Full	everything	No
Custom	any combination	Your choice

Creating a Full key asks the person to sign in again first. Each account’s own safety settings can still hold sends for approval, whatever the key says.

Account scope

A key or connected app reaches all accounts in the workspace (including ones connected later), selected profiles (including accounts added to them later), or selected accounts.