Skip to content
Help

Set scopes for an API token

API tokens are used to manage a range of tasks using the Koordinates APIs.

Users can set the scopes for an API token by creating an API key in the user interface.

  1. Select API Keys in your user menu. This opens the API Keys page at /my/api/.

  2. Select Create API Key, and enter a name for the key in API Key Label.

  3. Select Manual scope. (Data access gives the key the default data access scopes: query, tiles, catalog, wxs:wfs and wxs:esri.)

    The Add API key window on the Manual scope tab, showing the key label, expiry, domain and group controls, and the scope filter.

  4. Choose the scopes for your key. Scopes work in addition to dataset and service permissions and group membership, but don’t override them: a key never has wider access than the user account that created it.

  5. Optionally, set any of these controls:

    • Expire API key by time or date: the key stops working after 7, 30 or 365 days, or on a date you choose.
    • Lock API key to one or more domains: the key only works from the domains you list, one per line. Available to admins on eligible plans.
    • Restrict API key to a group: limit the key to datasets owned by a group, or to datasets accessible to a group. Available to site admins on eligible plans.

  6. Select Add.

  7. Copy your key. If the key has any scopes beyond the default data access scopes, you can’t view or copy it again later.

Scopes

Section titled “Scopes”
Scope Allows the key to
query Query layer data
tiles Access cartographic tile images (WMTS and XYZ)
catalog Search and view the data catalog
wxs:wfs Access OGC Web Feature Services (WFS)
wxs:esri Access Esri REST Services
items:read Search and view catalog items
items:write Create, edit and delete catalog items
layers:read Search and view tables and layers
layers:write Create, edit and delete tables and layers
documents:read Search and view documents
documents:write Create, edit and delete documents
sets:read Search and view sets
sets:write Create, edit and delete sets
sources:read Search and view data sources
sources:write Create, edit and delete data sources
exports:read Search, view and download exported data
exports:write Create new data exports
repos:read Search and view Kart repos
repos:push Push commits to Kart repos
repos:write Create, edit and delete Kart repos
users:read View group and user information
users:write Manage users and groups
users:me:read View your own user information
users:me:write Update your own user profile
viewers:read Search and view MapViewers
viewers:write Create, edit and delete MapViewers
indexeddata:read View indexed groups, sources and datasources
indexeddata:write Manage indexed groups, sources and datasources
notifications:read Retrieve notifications

A write scope includes the matching read scope. repos:write includes repos:push, and users:write includes users:read and users:me:write.

Every API view sends an Accepted-OAuth-Scopes response header naming the scope it needs. For creating and managing keys through the API (/tokens/), see the API Tokens section of the API reference.