API keys you could create but never use

Every permission carries a data scope: their own records, their team’s, or everything in the business. On the roles and users screens that is a dropdown beside each permission. On the API keys screen it was never drawn (an option the screen simply did not pass through), so every key ever issued took the default, “their own records”.

For a person that is a sensible default. For a key it means records belonging to whoever created it, which for an integration is usually none at all. So a key would authenticate, every permission on it would look right, and every list it asked for came back empty, with nothing on the screen to explain why and no control to change it.

The dropdown is there now, with a line explaining what scope means for a key rather than for a person. The default is deliberately still the narrow one. Widening access quietly because most keys want it widened is how a key ends up reading more than it was meant to.

Any key you created before today is still scoped to “their own records”, because that is what it was saved with: the scope was not editable, so it cannot have been anything else. If an integration of yours reads less than you expect, or nothing at all, that is why: issue a new key with the scope set, and revoke the old one.

Keys whose secret you never managed to copy are unusable and always were. Revoke them; nothing else is affected, and no data has changed.

Creating API keys remains an administrator-only action, as it was.