What a key can do
- Scope read: GET routes only.
- Scope write: every route the member's role allows.
- A contributor's key saves posts into review even when the request asks to publish.
- Approving needs a role that approves and the approval switch only the workspace owner sets.
Every route in the API reference lists the role action and the key scope it needs. Keys are shown once when made; store them like a password.