Gr4vy Scopes
Scopes claimed on the private-key JWT used for server-side Gr4vy API auth (Authorization: Bearer <jwt>).
| Scope | Purpose | Used for |
|---|---|---|
checkout-sessions.write | Create checkout sessions | Secure Fields / hosted checkout session create |
checkout-sessions.read | Read checkout sessions | Tokenized payment-method metadata (scheme, BIN, last4, expiry) before charge |
transactions.write | Create and mutate transactions | Payment create; capture, refund, void |
transactions.read | Read transactions | Status lookup, sync, and follow-up on existing payments |
buyers.write | Create and update buyers | Buyer records and shipping details attached to checkout |
buyers.read | Read buyers | Buyer and shipping-detail lookup |
buyers.billing-details.read | Read buyer billing-related PII | Billing / shipping detail required for fulfillment and risk |
digital-wallets.write | Create digital-wallet sessions | Apple Pay, Google Pay, and Paze merchant / wallet sessions |
payment-options.read | Read payment options | Eligible methods subject to flow rules (POST /payment-options) |
gift-cards.read | Read gift cards | Gift card balance verification (POST /gift-cards/balances) |
payment-services.read | Read payment services | List payment-service / connector UUIDs (GET /payment-services) |
There is no method-specific scope (e.g. PayPal). APMs and wallets use the same transactions.*, buyers.*, and related resource scopes; which methods appear is controlled by Gr4vy configuration and flow rules, not JWT scopes.
Scope claim values
From Authentication with JWTs — Scopes: the API supports the following values for the scopes claims.
| Scope | Description |
|---|---|
*.read | Allows read-access to any resource. This is used by default in the SDKs |
*.write | Allows write-access to any resource. This is used by default in the SDKs. This does not also allow read access. |
{resource_name}.read | Allows read-access to a type or resource. For example, payment-services.read enabled read-access for buyers data. |
{resource_name}.write | Allows write-access to a type or resource. For example, payment-services.write enabled write-access for buyers data. This does not also allow read access. |
embed | A scope that represents all the access needed by Embed. |
The following resource names are recognized. Please see the reference documentation for more details as to what scope is required per endpoint.
anti-fraud-servicesapi-logsbuyersbuyers.billing-detailscard-scheme-definitionscheckout-sessionsconnectionsdigital-walletsflowspayment-methodspayment-method-definitionspayment-optionspayment-service-definitionspayment-servicesreportstransactions