Scopes & Permissions

Keito checks both the credential type and the current permissions of the identity it belongs to. The credential type is an upper limit: user or Manager permissions cannot expand a narrowly scoped key.

Personal Read-Only Sync Keys

A personal read-only sync key is limited to seven GET requests for the key owner’s time and profile, the user and client directories, and assigned project list/item reads. It cannot perform writes or exceed the key owner’s current field visibility. See Personal Read-Only Sync Keys for the complete public contract.

Full-Access and Agent Keys

Full-access keys act within the current permissions of their associated identity. They do not grant Administrator access. An Agent user’s API key remains bound to an active Agent identity and can only access projects that identity is assigned to.

Permission Model

Role	Can create entries	Can approve	Can manage users	Can invoice
Member	Own entries only	No	No	No
Manager	Own + team	Yes	No	Yes
Administrator	All	Yes	Yes	Yes

Agent users are typically created as Members — they can create time entries and expenses for their assigned projects, but they cannot approve timesheets or manage other users.

Project Scoping

A full-access or Agent API key can only interact with projects the associated user is permitted to access. Attempting to create a time entry for an unassigned project returns HTTP 403.

Personal read-only sync project reads use the same active-assignment boundary. Removing an assignment immediately removes both collection and item visibility. Role, Manager-permission, project-manager, membership, and assignment changes do not require key rotation.

Client and project mutation permissions are more specific than a key’s broad scope. Managers need Edit clients and tasks to create or update clients, and only Owners/Administrators may archive or permanently delete them. Managers need Edit projects to create projects and must also manage a project to update or archive it. Project deletion is Owner/Administrator-only.