-
Type:
Suggestion
-
Resolution: Unresolved
-
Component/s: API keys / authentication
-
None
-
1
Summary: Provide a workflow or tool to identify minimum required scopes for an endpoint using Scoped API Tokens
Description:
Currently, developers adopting the new Scoped API Tokens face significant friction when trying to determine the "bare minimum" scopes required for their applications.
The Problem:
- API documentation is sometimes incomplete or missing the specific scope requirements for certain endpoints.
- Developers are forced into a "trial and error" workflow: generating a token, testing the application, identifying a 403/401 error, adding a scope, and repeating.
- This process is time-consuming and discourages the security best practice of "least privilege."
Suggested Solution:
Create a workflow or developer tool that allows users to:
- Input a list of REST API endpoints they intend to call.
- Automatically receive a list of the minimum scopes required to authorize those specific calls.
- (Optional) Integrate this into the API Token creation UI where a user can "Search by Endpoint" to add scopes.