Scopes and token security

A human OAuth token is limited by its issued scopes, the app’s current scope selection, the current consent, and the person’s live company permissions. Platform API keys and new company automations also follow their creator’s current access. See Team and integration permissions for dashboard setup and lifecycle behavior. Scope enforcement is identical for every scope: a request without the required scope fails with insufficient_scope rather than silently returning less data.

Ask for the narrowest set that does the job. Consent screens show every scope you request, and a request for money-moving access is the most common reason a company declines.

The scope catalog

SideShift defines 71 capability scopes. 69 of them can be requested by a third-party client and consented to by a company; offline_access is a protocol signal rather than a capability, and 1 scope (performance:read) is grantable only to SideShift’s own organisation. 16 scopes are marked sensitive: they move money or change company configuration, the consent screen highlights them, and their tools are rejected for sandbox tokens. Request only what your integration needs.

Scope	Grants	Sensitive
`campaigns:read`	Read your campaigns and payment structures.	No
`campaigns:write`	Create, update, and archive campaigns and payment structures.	No
`applications:read`	Read creator applications to your campaigns.	No
`applications:write`	Approve, reject, and update creator applications and social handle requests.	No
`creators:read`	Read creator profiles and collections.	No
`creators:write`	Invite creators to campaigns and update creator collections.	No
`contracts:read`	Read your creator contracts.	No
`contracts:write`	Create, accept, and cancel contracts.	No
`contracts:sign`	Sign contracts as the company and change the company signer.	Yes
`posts:read`	Read posts and their metrics.	No
`posts:write`	Set post approval status, mark/clear deletion, and manage analytics tags.	No
`analytics:read`	Read analytics and performance data.	No
`ads:read`	Read ad accounts, campaigns, delivery status, and performance data.	No
`ads:write`	Create and manage ad campaigns and connected ad accounts — this can spend money.	Yes
`payouts:read`	Read payouts, stats, and payout history.	No
`payouts:write`	Release and retry payouts, including one-time payouts and bonuses - this moves money. Quick-Pay has a separate permission.	Yes
`invoices:read`	Read your invoices.	No
`invoices:write`	Create, send, and void invoices.	Yes
`messages:read`	Read conversations and messages.	No
`messages:write`	Send messages, manage conversations and members, and upload attachments on your behalf.	Yes
`settings:read`	Read company settings.	No
`settings:write`	Change company settings.	Yes
`disputes:read`	Read creator-payment disputes and their evidence.	No
`disputes:write`	Resolve disputes and submit counter-evidence - this can move money.	Yes
`discover:read`	Open the Discover tab to find agencies, campaign managers, and creators, and read your own Discover listing.	No
`discover:write`	Publish, update, or remove your Discover marketplace offer.	No
`agencies:read`	Read agency dashboard, client lists, creator details, and payment receipts	No
`agencies:write`	Update agency campaign/contract/client notes, campaign status, and client archive status	No
`applicants:read`	Read access to applicants, including filtered lists, counts, and export	No
`applicants:write`	Write access to update applicant status, bookmarks, and resolve support channels	No
`video-submissions:read`	Read creator video submissions for your campaigns, including review status.	No
`video-submissions:write`	Approve, reject, or request revisions on video submissions, and delete submissions.	No
`booking:read`	Read creator booking settings, booking intents, and service types.	No
`booking:write`	Create and modify bookings, send booking requirements, and other write operations	No
`brand-content-pages:read`	List and view brand content pages (public published pages visible to all, drafts visible to writers only)	No
`brand-content-pages:write`	Create, update, and manage brand content pages (create drafts, publish, manage public share tokens)	No
`brand-livestream:read`	Read active livestreams, recordings, and settings for brand livestreams.	No
`brand-livestream:write`	Start/end livestreams, mint viewer tokens, rotate stream keys, and manage egress.	No
`brand-livestream:settings`	Update chat and moderation settings for brand livestreams.	No
`brand-verification:read`	Read access to brand verification status and request history	No
`brand-verification:write`	Create brand verification requests and prepare document uploads	No
`verification:read`	Read your identity verification status, profile, and required actions.	No
`brand-performance:read`	Read your own campaign spend/delivery health and creator-match shortlists. Requires SideShift to enable the Performance API for your company (manual provisioning).	No
`agency-performance:read`	Read performance data for permitted, delegated client brands in your agency’s subtree - per-client health, scorecards, creator relationships, and a portfolio rollup. Agency accounts only; requires SideShift to enable the Performance API.	No
`community-courses:read`	Read-only access to community course content and metadata	No
`community-courses:write`	Create, update, and delete community courses (educational content management)	No
`community-offers:read`	Read community offers, promo codes, and membership data	No
`community-offers:write`	Create, update, and delete community offers, promo codes, and Discord integration settings	No
`community-offers:checkout`	Create checkout sessions for community offer purchases (involves payment processing)	Yes
`community-offers:membership`	Link and resolve community offer memberships from purchases (involves payment processing)	Yes
`integrations:read`	Read Slack integrations, channels, templates, and configuration	No
`integrations:write`	Create, update, and delete Slack integrations, channels, templates, and workflows	No
`jobs:write`	Create new jobs and update existing jobs, including changing posting status, reposts, and job management. Costs job posting credits for new jobs.	No
`jobs:read`	List and read job data, including duplicate target companies. Read-only access to job details.	No
`recruit:read`	Search recruit students and view bookmarked recruits	No
`recruit:write`	Send recruit invites, manage bookmarks, and mint action tokens	No
`team:read`	Read access to team members list and company invites. Allows viewing member details, permissions, and pending invitations.	No
`team:write`	Write access to add, remove, and update team members, and create/send team invitations.	Yes
`quick-pay:read`	Read Quick-Pay drafts, schedules, templates, pending payments, and recent recipients.	No
`quick-pay:write`	Create, update, send, and cancel custom payouts, drafts, schedules, and templates - sending moves money to creators.	Yes
`wallet:read`	Read your company/agency wallet balance, summary, and ledger.	No
`wallet:write`	Top up (Stripe/bank transfer), reconcile, transfer balance, and record ledger entries - this moves money.	Yes
`wallet:withdraw`	Withdraw company wallet funds to a bank account or payout method. Company owners-only withdrawal policy still applies.	Yes
`scraper:read`	Read scraper usage, credit balance, and account configuration.	No
`scraper:write`	Run paid scraper requests, manage scraper keys, and purchase credits.	Yes
`billing:read`	Read subscription status, payment methods, bank-account status, and upgrade previews.	No
`billing:write`	Manage subscription, payment methods, and bank accounts - this changes what you are charged.	Yes
`agency-billing:read`	Read your agency billing configuration.	No
`agency-billing:write`	Update agency billing info, enable separate subs, generate tiered client checkout links, and assign included clients - this moves money.	Yes

Sensitive scopes

Sensitive scopes are not enforced differently, but they carry extra guards further down:

Their tools and endpoints are rejected for sandbox and test grants, so a test integration cannot move money or send outbound communication.
The MCP server can disable them globally with MCP_SAFE_MODE.
Money-moving writes require an Idempotency-Key, so a retried call cannot double-charge. See idempotency.

Verifying an access token

Access tokens are JWTs signed by SideShift. A resource server can verify one without calling SideShift on every request:

Fetch the signing keys

GET /api/oauth/v1/jwks returns the public JWKS. Cache it and refresh on an unknown kid, which is what a key rotation looks like from outside.

Check the signature and standard claims

Verify the signature against the matching kid, then check iss matches the issuer from discovery, aud matches https://app.sideshift.app/api/oauth/v1, and exp is in the future.

Check the scope for the operation

For a human grant, SideShift intersects the token’s scopes with the app’s current scope selection, current consent, and the subject’s live company permissions on every resource verification. A downgrade therefore takes effect immediately, even on a token that was already issued. The grant separately retains the original consented set, so an authorized role or permission change can take effect on the next refresh, but can never add a scope the company did not consent to. Anything outside the effective scopes must fail rather than degrade.

Signature and standard-claim checks can run offline. The live permission, client, and consent checks cannot: SideShift also checks revocation and subscription eligibility when a token calls its resources. A cryptographically valid token can still receive 401, 402, or 403 insufficient_scope. Do not use offline JWT verification as proof of current company access.

Do not treat a token as valid purely because it parses. A revoked grant produces a token that still verifies cryptographically until it expires.

Team role ceiling for human grants

Team members, scoped Platform API keys, OAuth grants, and MCP use the same public capability names. The dashboard groups them by page or resource with independent Read and Write selections. Signing contracts (contracts:sign), withdrawing funds (wallet:withdraw), and paid scraping (scraper:write) are separate permissions.

Owners retain full team access. Admin and Employee permissions can be customized.
A saved permissions.scopes array is the exact grant; an empty array grants no capabilities. Legacy boolean fields are derived from that selection.
Existing memberships without a scope array retain their previous behavior. In particular, legacy restricted Employees keep their reporting-only OAuth ceiling until an authorized manager saves an explicit scope selection.
A direct subaccount membership takes precedence over inherited agency membership. Canonical company and parent owners retain ownership authority.
Human OAuth grants and Platform API keys are intersected with the user’s current permissions on every verification. Removing membership or reducing permissions removes access from existing credentials. Refresh cannot exceed the consented grant.
settings:read permits credential inspection; settings:write permits creation and revocation. team:write cannot grant capabilities beyond the caller or credential, and a scoped credential cannot promote Owners or propagate team changes to siblings.

Agency credentials may delegate no subaccounts, selected subaccounts, or all current and future subaccounts. Each delegated call verifies the current parent relationship, user access, and the target’s scope ceiling. Aggregate reports filter to that same permitted set. Set X-Act-As-Company on each Platform API request, or act_as_subaccount_id on each MCP tool call. Neither changes the connected company. Switching the connection itself requires a new authorization. Existing unscoped Integration and Scraper keys keep their legacy behavior. Create new scoped keys in Settings → Platform API & MCP → API keys. Scoped Platform keys also work with /api/v1 through x-api-key; delegated aggregate reports use the Platform API. Signing a contract now requires contracts:sign; an existing grant with only contracts:write must be authorized for that additional permission. client_credentials tokens identify the app as their subject. New dashboard automations also retain the creator and enforce that person’s live company permissions on issuance and resource requests. Existing company-bound machine apps without a creator retain their binding. Dynamic registration and human consent do not authorize machine access. Follow Company automations for the dashboard-authorized flow.

Key rotation

Signing keys rotate. Clients that cache the JWKS should key their cache on kid and refetch when they see one they do not recognise, rather than on a fixed timer. Both discovery documents and the JWKS endpoint are public and unauthenticated.

Managing clients and grants from the dashboard

Registration does not have to go through POST /register. Settings → Platform API & MCP lets an authorized team member:

Register a client for their own company automation, or an app other SideShift companies can connect to
Review every third-party app the company has connected, with granted scopes, and revoke any connection
Browse this scope catalog interactively
Run read-only requests against the API without writing any code

A member with an explicit permissions.scopes array is checked against those scopes directly: settings:read to browse and inspect registered clients and connections, settings:write to register or revoke one. A member without a scopes array falls back to the legacy rule instead - owners and admins always qualify, and any other member qualifies only if their manageApiKeys permission is enabled. That is the quickest route for a single-company integration. Dynamic client registration remains the right path for a distributed app. An Employee who lacks settings:read (or, on a legacy membership, manageApiKeys) cannot register clients, manage API keys, or review connections, but can still open Get started on the same page to connect their own MCP session. That session is subject to the team-permission ceiling above.

Overview

Guides

SideShift Pixel

OAuth 2.1 & MCP

Legacy API (Deprecated)

Scopes and token security

The scope catalog

Sensitive scopes

Verifying an access token

Team role ceiling for human grants

Key rotation

Managing clients and grants from the dashboard

​The scope catalog

​Sensitive scopes

​Verifying an access token

​Team role ceiling for human grants

​Key rotation

​Managing clients and grants from the dashboard

The scope catalog

Sensitive scopes

Verifying an access token

Team role ceiling for human grants

Key rotation

Managing clients and grants from the dashboard