Scopes

# Scopes

import {Head} from "zudoku/components";

<Head>
  <title>Scopes | Tny</title>
</Head>

Scopes limit what an access token can do in Tny. Choose them when you create an [access token](/developers/authentication#access-tokens). Start with the narrowest scope that covers your integration. The shared [scopes guide](/developers/scopes) explains how parent scopes and write access work.

## Available scopes

### Broad scopes

| Scope | Access |
|---|---|
| `tny` | Every Tny API operation |
| `tny:read` | Read all Tny resources |
| `tny:write` | Read and change all Tny resources |

### Link scopes

| Scope | Access |
|---|---|
| `tny:links:read` | List and view shortened URLs |
| `tny:links:write` | Create, update, and delete shortened URLs, including custom social cards |

### Domain scopes

| Scope | Access |
|---|---|
| `tny:domains:read` | List and view link domains and domain redirects |

### Utility scopes

| Scope | Access |
|---|---|
| `tny:utilities:read` | Unshorten URLs and look up URL metadata |

<Callout type="info">
Scopes are hierarchical. `tny:write` includes every Tny write scope and its matching read scope. `tny` grants all Tny scopes.
</Callout>

## Example token configurations

### Read links and domains

Use separate read scopes when an integration only needs links and domains.

```text
tny:links:read tny:domains:read
```

### Manage links

```text
tny:links:write
```

Write access includes read access at the same level, so this token can also list and view links.

### Read everything

Use the broad read scope for reporting or monitoring across Tny.

```text
tny:read
```

### Use URL utilities

```text
tny:utilities:read
```