Read, Write, and sensitive actions
Each resource has its own permissions. Read and Write are independent: Write does not automatically include Read. Give a teammate both if they need to open a page and edit its data. A backend that only performs one write operation may need only that operation’s Write scope.
These examples are starting points, not role presets. Use the scope catalog
and each API operation’s required scope for the full list. Permission to use one page does not
grant every related resource: a campaign reader does not automatically get analytics or payouts.
Configure a teammate
- Select the company and open Settings → Team.
- Invite a teammate, or open Manage access for an existing member.
- Choose their role and select Read, Write, and any named sensitive actions for each resource. An Owner retains full company access. Admin and Employee access can be customized.
- Save. A manager cannot grant permissions they do not have. If an existing member has broader access than the manager, those selections remain visible and read-only; an owner must manage them.
What the teammate sees
Navigation, settings tabs, and edit controls follow access for the selected company. Read-only members can browse permitted data. Restricted analytics show an access notice instead of misleading zero metrics. Members can edit their personal profile and inspect their own company access under Settings → Profile, even without permission to list the team. Access refreshes when the window regains focus or the company context refreshes. Server checks run independently: leaving an old tab open does not authorize an operation after access is removed. Billing prices and wallet details require their own Read permissions; ordinary page loading does not require permission to inspect billing details.messages:read opens the inbox and its realtime stream, and lets the person keep their own
read/unread state, preferences and pins. messages:write sends messages, reacts, uploads files
and manages conversations. SideShift checks the current permissions on every request and every
socket frame, so a change applies at once. The product calls the conversation kinds “Support
chat”, “Direct message” and “Group chat”; the API keeps support channel as the wire name for a
support chat.How integration access is limited
Resource ownership, subscription eligibility, sandbox restrictions, and sensitive-action rules
also apply. A scope is permission to request an operation, not a bypass for those checks.
Removing a creator’s company access stops their Platform keys and new dashboard automations.
Reducing permissions narrows existing credentials on subsequent verified requests. If an
automation’s creator leaves, have an authorized owner create a replacement credential.
Increasing an app’s scope selection does not widen a token already issued. Request a new
authorization for new permissions. Disconnecting an OAuth connection revokes its grant;
reconnecting does not revive credentials issued before that revocation. Refresh tokens rotate
on use, and replaying an old refresh token can revoke the connection.
Existing members and integrations
Existing memberships without an explicit scope selection keep their legacy permissions. Saving an explicit selection replaces those defaults: an empty selection grants no company capabilities. Legacy restricted Employees retain their reporting-only OAuth limit until an authorized manager saves an explicit selection. Existing company-bound machine apps without a recorded creator retain their company binding. An Integration key (sk_live_ / sk_test_) created by a team member acts as that member: it
follows the member’s current company access and team permissions on every request, and it
stops working when the member is removed. Integration keys created by the company account
itself, and keys created before this binding existed, keep acting as the company. Connect,
Tracking, and Scraper keys keep their separate product contracts; none of these are converted
into scoped Platform keys. Prefer scoped Platform keys for new Platform
integrations. Existing OAuth grants with only contracts:write need new consent
for contracts:sign before signing contracts.
For agency credentials and direct-child precedence, follow Agency access.
For machine OAuth setup, follow Company automations.
Creator contact information
Reading a creator’s email or phone from any brand-facing surface requires thecreator_contact_info entitlement on the calling company. This applies to the
OAuth API, Platform API keys, CSV exports, and MCP tools that return roster or
payout contact fields. Without the entitlement those fields are omitted, null,
or blank (CSV cells). The entitlement is account-level — not a scope you request
at consent — and is granted by SideShift for tenants that need contact data.