# Permissions and data access

What an API key can reach, and how to give it the right access.

Two things decide what a request can do.

## 1. The key's permissions

Each API key has its own list of permissions, which you set on the Tokens page. Each endpoint in the [API reference](/reference) shows the permission it needs, such as `clients.VIEW` or `clients.MANAGE`.

If a key doesn't have the permission, the API returns `403`.

## 2. What the key's owner can see

A key sees the same records as the person who created it. If that person only has access to one team or brand, so does the key.

## Things to know

- Permissions are saved on the key when you set them. Changing someone's role doesn't change their existing keys, so review keys when roles change.
- Paid add-on features, such as telephony, can't be reached with an API key.
- Password, two-factor and login session actions always need a signed-in person, so API keys can't use them.
- A key with permission to manage API keys can create other keys, with any permission its owner has. Only give this permission when you need it.