Scope a key or user | Faustine Docs

A scope is the set of operations a credential can call. It selects from the operations the environment exposes. A client sees only the operations in the scope of the credential it connects with: they are the only ones in the MCP tool list and in the results of search_operations.

Change the scope

To change what a key or user can call:

In the portal, go to Agent Gateway and select your gateway.
Select the Access tab, then API keys or Users, and select the credential.
In the Scope & access section, select a Preset or select operations in the list.
- Everything (*) covers every exposed operation, including the ones you expose later.
- All reads selects every read operation that is exposed now.
- None clears the selection so you can select operations one by one.
Select Save changes.

For a user, the change applies to existing sessions on their next call. A call to an operation outside the scope is refused with scope.

Make a credential read-only

In Scope & access, turn on Read-only and save. Every write operation in the scope is refused with read_only. The operations stay in the scope, so turning the switch off restores them.

Read-only is independent of confirmation. Use it for a reporting client, or for the first weeks of a rollout.

Restrict the connections

When an API has more than one connection in the gateway, the credential's page has an Allowed connections section. Select the connections of each API the credential can use. With nothing selected, the credential can use every connection.

Use this to give a partner a key that reaches only their own deployment. See Routing: fixed, dynamic and fan-out for how a call picks among the allowed connections.

What the credential reaches

The top of Scope & access shows what the credential can call once read-only and its confirmation choice apply. An operation that requires confirmation is hidden from a credential set to Refuse, even when it is in the scope. See Confirmation.

Troubleshooting

Symptom	Cause	Fix
A call is refused with `Denied (scope): This key is not scoped for "…"`	The operation is not in the credential's scope.	Add it under Scope & access.
An operation in the scope does not appear in the client	The operation is hidden in the environment, or it requires confirmation and the credential is set to Refuse.	Expose it in the Operations tab, or change the credential's Confirmation choice.
A key lost operations after an API was removed from the gateway	Removing an API removes its operations from every scope.	Add the API again and select the operations.

Next steps

Choose which operations are exposed: hide an operation from every credential.
Set how a credential confirms writes: decide what happens on operations that require confirmation.
Limits and quotas: rate and quota limits per credential.