Scopes and roles
Scopes are the same strings for secret keys, OAuth tokens (MCP connectors) and dashboard users (derived from the member's role).
Write scopes do not imply read scopes, except conversions:write (includes conversions:read) and org:admin (includes project:create).
Scopes
| Scope | Allows |
|---|---|
analytics:read | Read analytics: overview, breakdowns, sessions, pages, videos, funnels, relevance, events, SQL |
leads:read | Read leads and identify data (personal data) |
leads:write | Create, update and erase leads |
events:write | Send server-side events |
conversions:read | List conversions and their upload status |
conversions:write | Mark, retry and update conversions (uploads to ad platforms) |
ads:read | Read ad cost and performance data |
ads:write | Connect ad accounts, trigger syncs, edit UTM mappings |
config:write | Edit goals, funnels, relevance model, event schemas, questionnaires |
project:admin | Project settings, tracking config, publishable keys, conversion destinations |
project:create | Create projects (a narrowed key or grant gains access to the projects it creates) |
org:admin | Projects, secret keys, members of the organization |
ingest:proxy | First-party proxy: trusted client IP/country headers on ingest |
Roles
Dashboard members get the scopes of their role. leads:read and leads:write additionally need the member's personal-data permission (pii); owners always have it. Owners and admins may also put ingest:proxy on keys they create.
| Scope | owner | admin | analyst | viewer |
|---|---|---|---|---|
analytics:read | yes | yes | yes | yes |
leads:read | yes | yes | yes | – |
leads:write | yes | yes | – | – |
events:write | yes | yes | – | – |
conversions:read | – | – | yes | – |
conversions:write | yes | yes | – | – |
ads:read | yes | yes | yes | yes |
ads:write | yes | yes | – | – |
config:write | yes | yes | yes | – |
project:admin | yes | yes | – | – |
project:create | yes | yes | – | – |
org:admin | yes | yes | – | – |
ingest:proxy | – | – | – | – |
OAuth consent
- Read only:
analytics:read,conversions:read,ads:read. - Read and write (default):
analytics:read,conversions:read,ads:read,events:write,conversions:write,ads:write,config:write,project:admin,project:create,ingest:proxy. - Opt-in checkboxes, unchecked by default:
org:admin,leads:read,leads:write(personal-data scopes are only offered to members with thepiipermission).
A grant never exceeds what the user can do in the organization right now: every request intersects the granted scopes with the member's live role.