# Card Issuing Product Update - Scoped Tokens

Here's what's new with our Cards-as-a-Service Line

## New Feature: Scoped Tokens - Fine-Grained API Key Permissions

Control exactly what each API key can do — limit integrations to read-only, scope keys by function, and reduce your security exposure without changing a single line of existing code.

### Why This Matters

Previously, any valid API key had full access to every CaaS route. There was no way to restrict a key to read-only, or to limit it to specific operations. As integrations grow more complex (e.g. more teams, more third-party tools, more automated workflows, etc.) that all-or-nothing model creates unnecessary risk.

**Scoped Tokens lets you apply the principle of least privilege: each API key only carries the permissions it actually needs.**

#### **1. Secure Reporting Integrations**

**‍** Lock analytics or BI tools to READ_ALL — they can pull data but can’t create or modify cards.

#### **2. Sandbox Third-Party Vendors**

Give external integrations only what they need. If a vendor key is ever exposed, the blast radius stays small.

#### **3. Cleaner Internal Access Controls**

Separate keys for separate teams. Eng can have write access; finance stays read-only.

Make a call to a `/cards` or `/transactions` endpoint using the scoped key. A `READ_ALL` key should succeed on `GET` requests and return **403** on `POST/PUT/DELETE`.

### What’s New?

#### 1. Manage Permissions Directly from the CaaS Dashboard

Clients can now grant `READ_ALL` and/or `WRITE_ALL` permissions to any API key directly from the **CaaS Dashboard** — no API calls needed, and no need to contact your Reap account team for setup.

Go to **Developer Settings → API Keys**, then click the ✏️ edit icon next to any key to assign its permissions.

#### Supported permission values:

| Method    | What This Does                                                                 |
|-----------|--------------------------------------------------------------------------------|
| `READ_ALL`| Read-only access across all CaaS resources (cards, transactions). Perfect for analytics and reporting integrations. |
| `WRITE_ALL`| Full write access. Required for workflows that issue, activate, or manage cards. |

#### **Current Limitation: Permissions are Additive Only**

Permissions can be granted to an existing key, but **cannot currently be removed**. To issue a key without any permissions, generate a new API key instead. The ability to remove permissions from an existing key will be supported in a future release.

#### **Important: Permission Enforcement is Now Live**

The following endpoints now require an explicit permission to be set on the API key. Keys with no permissions will receive a **403 Forbidden**:

- All `/cards` and `/cards/{cardId}` endpoints → V1 and V2
- `/transactions` and `/transactions/{cardId}` → V1

##### Disclaimer: **No action needed for existing integrations.**

All existing API keys have been automatically backfilled with `WRITE_ALL`.

That means your current workflows will continue working without any changes.

## Quick Set Up Guide

1. **Navigate to API Keys in the CaaS Dashboard**: Go to **Developer Settings → API Keys**. You'll see both your Production and Sandbox keys listed here.

2. **Click the edit icon next to the key you want to scope**:

Click the ✏️ pencil icon on the right side of the key row to open the permission editor.

3. **Grant the permission(s) and confirm**:

Select `READ_ALL`, `WRITE_ALL`, or both — then save. The change takes effect immediately. No `apiKeyId` or API call needed.

4. **Test in staging first**

## **Full API Reference & Documentation**

[Full API Reference](https://reap.readme.io/docs/scoped-tokens-api-key-permissions)

_Questions? Reach out to your Reap account team — we’re happy to walk through how Scoped Tokens can best fit your integration setup._

### Enjoy boundless financial services with Reap

[Try now](https://reap.global/contact-us)