Permissions and scope

Authentication determines both the available operations and the resources that can be queried. A user token can work with all of the user's resources, including resources created through any of the user's API Keys. An API Key can only work with resources created using that same key.

Operation	User token	API Key	Scope
/users/me and /users/me/subscriptions	Yes	No	User information and subscription
Create, list, query, update, revoke, activate, and delete API Keys	Yes	No	The user's keys
POST /files	Yes	Yes	The API Key is associated with the created file
List, query, download, and delete files	All user files	Only files created with the key	Scope depends on the credentials
Create runs	On the user's files	Only on files created with the key	The run is associated with the credentials
List and query runs and results	All user resources	Only resources created with the key	Includes result files
Manage file comments	Yes, on accessible resources	No	Comments are managed with user credentials

An API Key cannot manage other API Keys or access resources created with another API Key. An operation outside this scope may return 401 Unauthorized, 403 Forbidden, or 404 Not Found, depending on the operation and resource.

Storage, inference, concurrency, and API-key limits depend on the user's tier. See Tiers and limits for the published values.