OAuth scopes

Permission scopes for Hypery OAuth apps and API access

Scopes constrain delegated OAuth tokens. First-party session cookies and personal API keys (ak_…) are not scope-gated — they act as the user.

An OAuth app may only mint scopes that appear in both:

  1. The global allowlist below
  2. The scopes registered on that app

AI scopes

ScopeGrants
ai:chatChat completions (/chat/completions, /v1/ai/language-model)
ai:completionsAlias for chat completions
ai:modelsList / inspect models
ai:imagesImage generation, predictions, /v1/ai/image-model
ai:embeddingsPOST /api/v1/embeddings and /v1/ai/embedding-model
ai:audioTTS, transcriptions, realtime session mint

Embeddings and audio do not inherit from ai:chat.

Account & billing

ScopeGrants
readRead-oriented management APIs
writeMutating management APIs (where declared)
billing:readWallet / usage reads
billing:chargePOST /api/v1/usage/charge (Browserbase, realtime settle, Deepgram, …)

billing:charge is required for usage charges — ai:chat / write alone are rejected.

Least privilege

Example for a chat + voice + RAG + browser app:

read write ai:chat ai:embeddings ai:audio ai:images ai:models billing:read billing:charge