Token scopes

Every token carries a set of scopes that control which API operations it can call. Scopes are additive — a token with prequalify and quote can call those two surfaces and nothing else.

Scope catalog

Default behavior

All scopes are enabled on every token provisioned through the standard checkout or partner onboarding flow. You do not need to configure scopes explicitly unless you want to restrict a token to a subset of operations.

Creating a least-privilege token

For production services that only need one capability — for example, a prequalification-only integration — create a scoped token from the Dashboard:

1. Open dashboard.isaapi.com → API Keys.
2. Click Generate new token.
3. Deselect all scopes, then select only the scopes your service needs.
4. Click Save. The new token value is shown once — store it in a secrets manager.

Using a scoped token limits blast radius if the token is leaked: an attacker with a prequalify-only token cannot access billing, usage data, or webhook configuration.

Scope errors

If a token lacks the required scope for an operation, the API returns:

{
  "code": "permission_denied",
  "status": 403,
  "detail": "This token does not have the 'quote' scope.",
  "advice_code": "generate_scoped_token"
}

See permission_denied for remediation steps.

See also

• Authentication guide
• Token rotation
• Error: permission_denied