Scopes
The permission catalogue a Gigadrive token can carry, and how each request is checked against it.
A scope is the unit of permission on a token. Every API route names the one scope it requires, and a token without it is refused before any lookup happens.
OIDC scopes
| Scope | Grants |
|---|---|
openid | An ID token, and access to the UserInfo endpoint |
profile | name, family_name, given_name, nickname, picture, updated_at |
email | email and email_verified |
offline_access | A refresh token, valid for 30 days |
Platform scopes
| Scope | Grants |
|---|---|
platform:organizations:read | Read organizations, their members, and their product access |
platform:organizations:write | Create an organization, on a user token only |
platform:api_keys:read | List an application's API keys, without secrets |
platform:api_keys:write | Create an API key |
platform:api_keys:delete | Revoke an API key |
platform:organizations:delete | Valid scope string, but no endpoint requires it. Organizations cannot be deleted. |
Gigadrive Network scopes
They all follow network:<resource>:<action>.
| Resource | Actions |
|---|---|
applications | read, write, delete |
deployments | read, write, delete, trigger |
env_vars | read, write, delete |
storage_buckets | read, write, delete |
storage_objects | read, write, delete |
storage_s3_credentials | read, write, delete |
requests | read |
sticky_sessions | write |
image_optimization | read, purge |
runtime_cache | read, write, revalidate |
ai_gateway | chat, models, usage:read, budgets:read, budgets:write, policies:read, policies:write |
network:applications:delete is a valid scope string that no endpoint requires today, like platform:organizations:delete.
A scope is not an entitlement
Every route re-checks access per request
A token is valid for five minutes, and access can change inside that window. Holding network:deployments:write says
the token was allowed to ask, not that the organization still has access to the product or that you are still a
member. The check runs again on every request, so a token that worked a minute ago can be refused now.
Product access describes what that second check resolves.
Scopes bound to an application
Five AI Gateway scopes behave differently at authorization time: network:ai_gateway:usage:read, budgets:read, budgets:write, policies:read and policies:write. They govern spend and model policy for a whole organization, so the OAuth client must be bound to a Gigadrive Network application and the signed-in user must have access to that application's organization before consent or token issuance can proceed. Requesting one from an unbound client fails the entire authorization request rather than dropping the scope.
The gigadrive CLI leaves those five out of its login scopes for that reason, and asks for network:ai_gateway:chat and network:ai_gateway:models instead.
Legacy names
Scopes used to be un-namespaced: deployments:write, api_keys:read, ai_gateway:chat. Those strings are still accepted and map one to one onto the canonical names, so old tokens and old configuration keep working. Write the canonical form in anything new.
Choosing a set
Ask for the narrowest set the job needs, then check it. An API key inherits nothing by default beyond network:env_vars:read, and it can never be granted more than the token that created it holds. API keys covers those rules, and Authentication shows which scope each endpoint names.