Scopes and token security

A SideShift access token carries exactly the scopes a company consented to, and nothing else. Scope enforcement is identical for every scope: a request without the required scope fails with insufficient_scope rather than silently returning less data.

Ask for the narrowest set that does the job. Consent screens show every scope you request, and a request for money-moving access is the most common reason a company declines.

The scope catalog

SideShift defines 65 capability scopes. 63 of them can be requested by a third-party client and consented to by a company; offline_access is a protocol signal rather than a capability, and 1 scope (performance:read) is grantable only to SideShift’s own organisation. 11 scopes are marked sensitive: they move money or change company configuration, the consent screen highlights them, and their tools are rejected for sandbox tokens. Request only what your integration needs.

Scope	Grants	Sensitive
`campaigns:read`	Read your campaigns and payment structures.	No
`campaigns:write`	Create, update, and archive campaigns and payment structures.	No
`applications:read`	Read creator applications to your campaigns.	No
`applications:write`	Approve, reject, and update creator applications.	No
`creators:read`	Read creator profiles and collections.	No
`creators:write`	Invite creators to campaigns and update creator collections.	No
`contracts:read`	Read your creator contracts.	No
`contracts:write`	Create, accept, and cancel contracts.	No
`posts:read`	Read posts and their metrics.	No
`posts:write`	Set post approval status, mark/clear deletion, and manage analytics tags.	No
`analytics:read`	Read analytics and performance data.	No
`payouts:read`	Read payouts, stats, and payout history.	No
`payouts:write`	Execute, quick-pay, and release payouts to creators — this moves money.	Yes
`invoices:read`	Read your invoices.	No
`invoices:write`	Create, send, and void invoices.	Yes
`messages:read`	Read conversations and messages.	No
`messages:write`	Send messages on your behalf.	No
`settings:read`	Read company settings.	No
`settings:write`	Change company settings.	Yes
`disputes:read`	Read creator-payment disputes and their evidence.	No
`disputes:write`	Resolve disputes and submit counter-evidence — this can move money.	Yes
`discover:read`	Read your Discover marketplace offer/listing.	No
`discover:write`	Publish, update, or remove your Discover marketplace offer.	No
`agencies:read`	Read agency dashboard, client lists, creator details, and payment receipts	No
`agencies:write`	Update agency program/contract/client notes, program status, and client archive status	No
`applicants:read`	Read access to applicants, including filtered lists, counts, and export	No
`applicants:write`	Write access to update applicant status, bookmarks, and resolve support channels	No
`video-submissions:read`	Read creator video submissions for your campaigns, including review status.	No
`video-submissions:write`	Approve, reject, or request revisions on video submissions, and delete submissions.	No
`booking:read`	Read creator booking settings, booking intents, and service types.	No
`booking:write`	Create and modify bookings, send booking requirements, and other write operations	No
`brand-content-pages:read`	List and view brand content pages (public published pages visible to all, drafts visible to writers only)	No
`brand-content-pages:write`	Create, update, and manage brand content pages (create drafts, publish, manage public share tokens)	No
`brand-livestream:read`	Read active livestreams, recordings, and settings for brand livestreams.	No
`brand-livestream:write`	Start/end livestreams, mint viewer tokens, rotate stream keys, and manage egress.	No
`brand-livestream:settings`	Update chat and moderation settings for brand livestreams.	No
`brand-verification:read`	Read access to brand verification status and request history	No
`brand-verification:write`	Create brand verification requests and prepare document uploads	No
`verification:read`	Read your identity verification status, profile, and required actions.	No
`brand-performance:read`	Read your own campaign spend/delivery health and creator-match shortlists. Requires SideShift to enable the Performance API for your company (manual provisioning).	No
`agency-performance:read`	Read performance data for every client brand in your agency’s subtree — per-client health, scorecards, creator relationships, and a portfolio rollup. Agency accounts only; requires SideShift to enable the Performance API.	No
`community-courses:read`	Read-only access to community course content and metadata	No
`community-courses:write`	Create, update, and delete community courses (educational content management)	No
`community-offers:read`	Read community offers, promo codes, and membership data	No
`community-offers:write`	Create, update, and delete community offers, promo codes, and Discord integration settings	No
`community-offers:checkout`	Create checkout sessions for community offer purchases (involves payment processing)	Yes
`community-offers:membership`	Link and resolve community offer memberships from purchases (involves payment processing)	Yes
`integrations:read`	Read Slack integrations, channels, templates, and configuration	No
`integrations:write`	Create, update, and delete Slack integrations, channels, templates, and workflows	No
`jobs:write`	Create new jobs and update existing jobs, including changing posting status, reposts, and job management. Costs job posting credits for new jobs.	No
`jobs:read`	List and read job data, including duplicate target companies. Read-only access to job details.	No
`recruit:read`	Search recruit students and view bookmarked recruits	No
`recruit:write`	Send recruit invites, manage bookmarks, and mint action tokens	No
`team:read`	Read access to team members list and company invites. Allows viewing member details, permissions, and pending invitations.	No
`team:write`	Write access to add, remove, and update team members, and create/send team invitations.	Yes
`quick-pay:read`	Read Quick-Pay drafts, schedules, templates, approvals, pending payments, and recent recipients.	No
`quick-pay:write`	Create/update/send Quick-Pay drafts, schedules, templates, and approvals — sending moves money to creators.	Yes
`wallet:read`	Read your company/agency wallet balance, summary, and ledger.	No
`wallet:write`	Top up (Stripe/bank transfer), reconcile, transfer balance, and record ledger entries — this moves money.	Yes
`billing:read`	Read subscription status, payment methods, bank-account status, and upgrade previews.	No
`billing:write`	Manage subscription, payment methods, and bank accounts — this changes what you are charged.	Yes
`agency-billing:read`	Read your agency billing configuration.	No
`agency-billing:write`	Update agency billing info, generate subscription links, toggle separate subs, and assign free clients — this moves money.	Yes

Sensitive scopes

Sensitive scopes are not enforced differently, but they carry extra guards further down:

Their tools and endpoints are rejected for sandbox and test grants, so a test integration cannot move money or send outbound communication.
The MCP server can disable them globally with MCP_SAFE_MODE.
Money-moving writes require an Idempotency-Key, so a retried call cannot double-charge. See idempotency.

Verifying an access token

Access tokens are JWTs signed by SideShift. A resource server can verify one without calling SideShift on every request:

Fetch the signing keys

GET /api/oauth/v1/jwks returns the public JWKS. Cache it and refresh on an unknown kid, which is what a key rotation looks like from outside.

Check the signature and standard claims

Verify the signature against the matching kid, then check iss matches the issuer from discovery, aud matches https://app.sideshift.app/api/oauth/v1, and exp is in the future.

Check the scope for the operation

The token’s scopes are the ones consented to. Anything outside them must fail rather than degrade.

Verification is stateless up to this point. SideShift additionally applies runtime checks on its own side that a third party cannot replicate, including whether the grant has since been revoked and whether the company’s subscription is still active, so a structurally valid token can still be rejected with 401 or 402.

Do not treat a token as valid purely because it parses. A revoked grant produces a token that still verifies cryptographically until it expires.

Key rotation

Signing keys rotate. Clients that cache the JWKS should key their cache on kid and refetch when they see one they do not recognise, rather than on a fixed timer. Both discovery documents and the JWKS endpoint are public and unauthenticated.

Managing clients and grants from the dashboard

Registration does not have to go through POST /register. Settings → OAuth & MCP lets owners, admins, and members with the manageApiKeys permission:

Register a client for their own company automation, or an app other SideShift companies can connect to
Review every third-party app the company has connected, with granted scopes, and revoke any connection
Browse this scope catalog interactively
Run read-only requests against the API without writing any code

That is the quickest route for a single-company integration. Dynamic client registration remains the right path for a distributed app.

Guides

OAuth 2.1 & MCP

Legacy API (Deprecated)

Scopes and token security

The scope catalog

Sensitive scopes

Verifying an access token

Key rotation

Managing clients and grants from the dashboard

​The scope catalog

​Sensitive scopes

​Verifying an access token

​Key rotation

​Managing clients and grants from the dashboard

The scope catalog

Sensitive scopes

Verifying an access token

Key rotation

Managing clients and grants from the dashboard