Scopes & permissions

Least-privilege scopes on API keys and MCP tokens.

Allowlist

• checkout:read / checkout:write
• invoices:read / invoices:write
• offerings:read / offerings:write
• escrow:read / escrow:write
• verification:read / verification:write
• webhooks:read / webhooks:write

Missing scope → 403 missing_scope. KYB rejected orgs → writes blocked with kyb_rejected.