Permissions (API)
The specific actions an API key or OAuth token is authorised to perform read-only, write, delete, admin. Best practice: grant automation credentials only the minimum permissions required. An invoice automation should never have permission to delete contacts.
Expert insight
API permissions granted more broadly than a workflow actually needs (full read-write access when the workflow only ever reads data) increase the damage a leaked credential or a workflow bug can cause, scoping API permissions to the minimum the workflow genuinely requires limits the blast radius of anything going wrong.
In a real workflow
A reporting workflow uses a read-only API key, so it cannot modify data even if misused.
Common mistakes
- Using admin permissions for everything.
- No review when people leave.
Complexity level
Anyone can understand this no technical background needed.
Related terms
See it in action
Want Permissions (API) built into your automation?
Book a free audit and we'll show you exactly how this applies to your business.
Get my free automation plan →Who we build for
Run a firm, an agency or an online store? We automate the work behind it.
Done-for-you n8n workflows and Claude AI agents, fixed price, maintained for you.
- Professional firms Onboarding, documents, billing and reporting run on their own. See what we automate →
- Agencies and SaaS teams Custom n8n and Claude builds, client reporting and internal tools. See what we automate →
- E-commerce brands Orders, support, returns and stock handled without the busywork. See what we automate →
More in Security
Keep exploring
Environment variable
A configuration value stored outside your workflow code API keys, pass…
JWT (JSON Web Token)
A compact, self-contained authentication token used by many APIs. JWTs…
OAuth (Open Authorisation)
An authentication standard that lets users grant third-party apps acce…
Token (API)
A credential string used to authenticate API requests. Tokens are eith…
Webhook security
Verifying that incoming webhooks are genuinely from the expected sourc…
Access token
A short-lived credential issued after OAuth authentication that grants…
Go deeper
Guides that cover Permissions
7 Best Airtable Alternatives in 2026: Open Source, Cheaper and More Powerful Options
The seven Airtable alternatives worth considering in 2026, from open-source Baserow, NocoDB and Grist to SmartSuite, Smartsheet, Notion and Google Sheets, compared on power, ease, cost at scale and data ownership.
Notion vs Confluence in 2026: Pricing, Features and the Right Knowledge Base for Your Team
Notion vs Confluence compared on what decides it: writing experience, structure and permissions, databases, Jira integration, AI, real annual cost for 25 users and a clear pick by team type.
The Joiner Mover Leaver Policy Template: Ownership, SLAs, and Compliance
The joiner-mover-leaver policy template itself: section-by-section ownership matrix, SLA language by termination type, and the three ownership gaps our client audits find most often.