Scopes

Scopes use the resource:action format. The assignable API-key registry is derived from the live RBAC registries and then filtered by key kind.

Assignment Rules

A key can never be created with more scope than its creator holds. Unknown scopes are rejected with 400 and the VALIDATION_ERROR code. The assignable registry does not include wildcard scopes.

The deny-list is never assignable to any API-key kind:

Scope	Reason
apikeys:create	API keys must not mint more API keys.
apikeys:edit	API keys must not manage the API-key credential family.
tokens:create	API keys must not mint popout tokens.
account:delete	API keys must not delete the tenant they automate.

GET /v1/api-keys/permissions?kind=personal|service|developer returns the assignable registry for each key kind. GraphQL apiKeyAssignablePermissions(kind: ApiKeyKind!) supports PERSONAL and SERVICE; the generated GraphQL enum has no DEVELOPER member, so the developer registry is available through REST.

Registry

Events

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
events:read	Read Events	Yes	Yes	No
events:create	Create Events	Yes	Yes	No
events:userinfo	Event User Info	Yes	Yes	No

Overlays

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
overlays:read	Read Overlays	Yes	Yes	No
overlays:create	Create Overlays	Yes	Yes	No
overlays:edit	Edit Overlays	Yes	Yes	No
overlays:delete	Delete Overlays	Yes	Yes	No
overlays:access-read	Read Overlay Access	Yes	Yes	No
overlays:access-grant	Grant Overlay Access	Yes	Yes	No
overlays:access-revoke	Revoke Overlay Access	Yes	Yes	No

Spotify

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
spotify:read	Read Spotify	Yes	Yes	No
spotify:playback	Spotify Playback	Yes	Yes	No
spotify:volume	Spotify Volume	Yes	Yes	No
spotify:queue	Spotify Queue	Yes	Yes	No
spotify:playlist	Spotify Playlists	Yes	Yes	No
spotify:device	Spotify Devices	Yes	Yes	No
spotify:worker	Spotify Worker	Yes	Yes	No

Chat

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
chat:read	Read Chat	Yes	Yes	No
chat:write	Write Chat	Yes	Yes	No
chat:userinfo	Chat User Info	Yes	Yes	No
chat:delete	Delete Chat Messages	Yes	Yes	No
chat:ban	Ban Chat Users	Yes	Yes	No
chat:timeout	Timeout Chat Users	Yes	Yes	No
chat:notes	Chat User Notes	Yes	Yes	No
chat:raid	Cancel Raids	Yes	Yes	No
chat:refresh_user	Refresh User Profile	Yes	Yes	No
chat:poll	End Polls	Yes	Yes	No
chat:prediction	End Predictions	Yes	Yes	No

Connections

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
connections:read	Read Connections	Yes	Yes	No
connections:create	Create Connections	Yes	Yes	No
connections:edit	Edit Connections	Yes	Yes	No
connections:delete	Delete Connections	Yes	Yes	No

Settings

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
settings:read	Read Settings	Yes	Yes	No
settings:edit	Edit Settings	Yes	Yes	No

Account

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
account:read	Read Account Settings	Yes	Yes	No
account:edit	Edit Account Settings	Yes	Yes	No
account:delete	Delete Account	No, deny-listed	No, deny-listed	No, deny-listed

Plan

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
plan:read	View Plan & Billing	Yes	Yes	No
plan:edit	Change Plan	Yes	Yes	No

Members

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
members:read	Read Members	Yes	Yes	No
members:create	Create Invites	Yes	Yes	No
members:edit	Edit Members	Yes	Yes	No
members:delete	Delete Members	Yes	Yes	No

Roles

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
roles:read	Read Roles	Yes	Yes	No
roles:edit	Edit Roles	Yes	Yes	No
roles:delete	Delete Roles	Yes	Yes	No

Login Assignments

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
login-assignments:read	View Login Assignments	Yes	Yes	No
login-assignments:create	Assign Login Connections	Yes	Yes	No
login-assignments:delete	Remove Login Assignments	Yes	Yes	No

Uploads

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
uploads:read	Read Uploads	Yes	Yes	No
uploads:create	Create Uploads	Yes	Yes	No
uploads:delete	Delete Uploads	Yes	Yes	No

Rewards

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
rewards:read	Read Rewards	Yes	Yes	No
rewards:create	Create Rewards	Yes	Yes	No
rewards:edit	Edit Rewards	Yes	Yes	No
rewards:delete	Delete Rewards	Yes	Yes	No

Tokens

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
tokens:read	Read Tokens	Yes	Yes	No
tokens:create	Create Tokens	No, deny-listed	No, deny-listed	No, deny-listed
tokens:edit	Edit Tokens	Yes	Yes	No
tokens:delete	Delete Tokens	Yes	Yes	No

API Keys

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
apikeys:read	Read API Keys	Yes	Yes	No
apikeys:create	Create API Keys	No, deny-listed	No, deny-listed	No, deny-listed
apikeys:edit	Edit API Keys	No, deny-listed	No, deny-listed	No, deny-listed
apikeys:delete	Delete API Keys	Yes	Yes	No

Automations

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
automations:read	Read Automations	Yes	Yes	No
automations:create	Create Automations	Yes	Yes	No
automations:edit	Edit Automations	Yes	Yes	No
automations:delete	Delete Automations	Yes	Yes	No
automations:execute	Execute Automations	Yes	Yes	No

OBS

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
obs:read	View OBS Config	Yes	Yes	No
obs:edit	Edit OBS Config	Yes	Yes	No
obs:delete	Delete OBS Config	Yes	Yes	No

Copyright

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
copyright:read	View Copyright	Yes	Yes	No
copyright:edit	Edit Copyright Lists	Yes	Yes	No
copyright:delete	Delete Copyright Entries	Yes	Yes	No
copyright:vote	Vote on Songs	Yes	Yes	No
copyright:report	Create Copyright Reports	Yes	Yes	No
copyright:recommend	Recommend Songs	Yes	Yes	No

Bot Modules

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
bot-modules:read	View Bot Modules	Yes	Yes	No
bot-modules:edit	Edit Bot Modules	Yes	Yes	No

Bot Commands

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
bot-commands:read	View Bot Commands	Yes	Yes	No
bot-commands:create	Create Bot Commands	Yes	Yes	No
bot-commands:edit	Edit Bot Commands	Yes	Yes	No
bot-commands:delete	Delete Bot Commands	Yes	Yes	No

Bot Connections

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
bot-connections:read	View Bot Connections	Yes	Yes	No
bot-connections:create	Create Bot Connections	Yes	Yes	No
bot-connections:delete	Delete Bot Connections	Yes	Yes	No

StreamElements

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
se-tokens:read	View SE Tokens	Yes	Yes	No
se-tokens:create	Create SE Tokens	Yes	Yes	No
se-tokens:delete	Delete SE Tokens	Yes	Yes	No

Extension Developer

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
extension-dev:read	View Developer Dashboard	Yes	Yes	Yes
extension-dev:create	Create Extensions	Yes	Yes	Yes
extension-dev:edit	Edit Extensions	Yes	Yes	Yes
extension-dev:delete	Delete Extensions	Yes	Yes	Yes
extension-dev:publish	Publish Extensions	Yes	Yes	Yes
extension-dev:analytics	View Extension Analytics	Yes	Yes	Yes
extension-dev:payouts	Manage Extension Payouts	Yes	Yes	Yes

Extension Store

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
extension-store:read	Browse Extension Store	Yes	Yes	No
extension-store:install	Install Extensions	Yes	Yes	No
extension-store:uninstall	Uninstall Extensions	Yes	Yes	No
extension-store:configure	Configure Extensions	Yes	Yes	No
extension-store:review	Review Extensions	Yes	Yes	No

Extension Data

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
extension-data:read	Read Extension Data	Yes	Yes	No
extension-data:edit	Edit Extension Data	Yes	Yes	No

Widgets

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
widgets:read	View Widgets	Yes	Yes	No
widgets:create	Create Widgets	Yes	Yes	No
widgets:edit	Edit Widgets	Yes	Yes	No
widgets:delete	Delete Widgets	Yes	Yes	No
widgets:access-read	Read Widget Access	Yes	Yes	No
widgets:access-grant	Grant Widget Access	Yes	Yes	No
widgets:access-revoke	Revoke Widget Access	Yes	Yes	No

Sounds

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
sounds:read	View Sounds	Yes	Yes	No
sounds:create	Upload Sounds	Yes	Yes	No
sounds:edit	Edit Sounds	Yes	Yes	No
sounds:delete	Delete Sounds	Yes	Yes	No
sounds:play	Play Sounds	Yes	Yes	No

Stream History

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
history:read	Read Stream History	Yes	Yes	No
history:share	Share History Reports	Yes	Yes	No
history:export	Export History Reports	Yes	Yes	No
history:delete	Delete Stream History	Yes	Yes	No

Public Stats

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
public-stats:read	Read Public Stats Settings	Yes	Yes	No
public-stats:edit	Edit Public Stats Settings	Yes	Yes	No

Audit Log

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
audit-log:read	Read Audit Log	Yes	Yes	No

Ideas

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
ideas:read	Read Ideas	Yes	No	No
ideas:create	Create Ideas	Yes	No	No
ideas:edit	Edit Own Ideas	Yes	No	No
ideas:delete	Delete Own Ideas	Yes	No	No
ideas:vote	Vote on Ideas	Yes	No	No

Idea Comments

Scope	Label	Personal lm_usr_*	Service lm_svc_*	Developer lm_dev_*
ideas:comment_read	Read Idea Comments	Yes	No	No
ideas:comment_create	Create Idea Comments	Yes	No	No
ideas:comment_edit	Edit Own Idea Comments	Yes	No	No
ideas:comment_delete	Delete Own Idea Comments	Yes	No	No
ideas:comment_vote	Vote on Idea Comments	Yes	No	No