Scopes and Permissions
Scopes define what data is included in the ID Token and whether to issue a Refresh Token. Permissions control what APIs and team resource an Access Token can interact with.
The following scopes are available:
| Scope | Description |
|---|---|
openid | Required permission, needed to issue an ID Token for user identification. |
profile | Enabling this scope grants access to the user's basic profile information, including name, username, and profile picture, in the ID Token. |
email | Enabling this scope grants access to the user's email address in the ID Token. |
offline_access | Enabling this scope issues a Refresh Token. |
Each permission covers one resource or product, such as Deployments or Domains. Some permissions offer a single access option, while others let the user choose one, such as Read Only or Read and Write. The option the user grants sets what an Access Token can do with the resource:
| Access | Description |
|---|---|
| Read Only | Read the resource's data. |
| Read and Write | Read and change the resource's data. |
| Manage | Enable or disable a product. Includes everything Read Only grants. |
| Use | Use a capability without access to view the resource it consumes. |
Permissions are grouped by where a user grants them: to a team or to a project.
The following permissions are available:
| Permission | Access | Description |
|---|---|---|
| Access Groups | Read Only | Read Access Groups. |
| Activity Events | Read Only | Read activity events. |
| AI Gateway | Use | Use AI Gateway. |
| AI Gateway API Keys | Read and Write | Read and make changes to AI Gateway API keys. |
| AI Gateway Guardrails | Read Only Read and Write | Read and manage AI Gateway guardrails. |
| AI Gateway Private Models | Read Only Read and Write | Read and manage AI Gateway private model configurations. |
| AI Gateway Rules | Read Only Read and Write | Read and manage AI Gateway routing rules. |
| AI Gateway Virtual Models | Read Only Read and Write | Read and manage AI Gateway virtual model configurations. |
| Alerts | Read Only Read and Write | Read and manage alerts and alert rules. |
| All Environment Variables | Read and Write | Manage all project environment variables. |
| Automations | Read Only Read and Write | Read and manage automations. |
| Billing | Read Only Read and Write | Read billing information and make purchases. |
| Blob | Read and Write | Manage Blob storage. |
| Connectors | Read Only Read and Write | Create, configure, connect, and remove Vercel Connect connectors. |
| Container Registry | Read Only Read and Write | Read and manage container registry images and tags. |
| Domains | Read Only Read and Write | Read and make changes to domains. |
| Drains | Read and Write | Manage Drains. |
| Global Config | Read and Write | Manage Global Config. |
| Integration Configurations | Read Only Read and Write | Read and make changes to integration configurations. |
| Integration Resources | Read Only Read and Write | Read and make changes to integration resources. |
| KMS | Read Only Read and Write | Read and manage KMS issuers and project grants. |
| Messageboard | Read Only Read and Write | Create, update, and delete team boards, spaces, and tasks. |
| Monitoring | Read Only | Read Monitoring data. |
| Remote Cache | Read Only Read and Write | Manage Remote Cache. |
| Team | Read Only | Read your Vercel team data. |
| Team Members | Read and Write | Invite, remove, and change the roles of team members. |
| Webhooks | Read Only | List webhooks. |
| Permission | Access | Description |
|---|---|---|
| CDN Cache | Read and Write | Manage CDN Cache. |
| Deployments | Read Only Read and Write | Read and make changes to deployments. |
| Domain Registrar | Read and Write | Buy or transfer-in new domains. |
| Firewall | Read Only Read and Write | Read and manage Firewall configuration and IP blocking rules. |
| Flags | Read Only | Read feature flags. |
| Non-Production Environment Variables | Read Only Read and Write | Manage non-production project environment variables. |
| Non-Production Flags | Read and Write | Manage non-production feature flags. |
| Production Environment Variables | Read Only Read and Write | Manage production project environment variables. |
| Production Flags | Read and Write | Manage production feature flags. |
| Project Protection Bypass | Read and Write | Manage project protection bypass rules. |
| Project Trusted Sources | Read Only Read and Write | Read and manage project trusted sources. |
| Projects | Read Only Read and Write | Read and make changes to authorized projects. |
| Sandboxes | Read Only Read and Write | Read and manage sandboxes. |
| Schedules | Read Only Read and Write | Read, manage, and manually invoke project schedules. |
| Speed Insights | Read Only Manage | Enable or disable Speed Insights. |
| Web Analytics | Read Only Manage | Enable or disable Web Analytics. |
Last updated February 26, 2026
Was this helpful?