Scopes & Permissions
Keito checks both the credential type and the current permissions of the identity it belongs to. The credential type is an upper limit: user or Manager permissions cannot expand a narrowly scoped key.
Personal Read-Only Sync Keys
A personal read-only sync key is limited to eight GET requests for the key owner’s time and profile, the user and client directories, and assigned project list/item reads. It cannot perform writes or exceed the key owner’s current field visibility. See Personal Read-Only Sync Keys for the complete public contract.
Full-Access and Agent Keys
Full-access keys act within the current permissions of their associated identity. They do not grant Administrator access. An Agent user’s API key remains bound to an active Agent identity and can only access projects that identity is assigned to.
Eligible active internal Members and Managers can create their own key under Settings > API & Developers > Personal API keys, selecting All permitted operations in API key access. This key is bound to the person creating it. Administrators can issue integration keys for other members or Agent identities. See API key creation for both paths.
Creating a new full-access key does not upgrade an existing read-only key. Read-only rotation also preserves the limited credential type.
Permission Model
| Role | Can create entries | Can approve | Can manage users | Can invoice |
|---|---|---|---|---|
| Member | Own entries only | No | No | No |
| Manager | Own + permitted team entries | When permitted | No | When permitted |
| Administrator | All | Yes | Yes | Yes |
Agent users are typically created as Members — they can create time entries and expenses for their assigned projects, but they cannot approve timesheets or manage other users.
Manager capabilities depend on the workspace’s granular permissions and the records they can access. The All permitted operations choice never overrides these checks.
Project Scoping
A full-access or Agent API key can only interact with projects the associated user is permitted to access. Attempting to create a time entry for an unassigned project returns HTTP 403.
Personal read-only sync project reads use the same active-assignment boundary. Removing an assignment immediately removes both collection and item visibility. Role, Manager-permission, project-manager, membership, and assignment changes do not require key rotation.
Client and project mutation permissions are more specific than a key’s broad scope. Managers need Edit clients and tasks to create or update clients, and only Owners/Administrators may archive or permanently delete them. Managers need Edit projects to create projects and must also manage a project to update or archive it. Project deletion is Owner/Administrator-only.