Scoped Project API Key
A scoped project API key lets you choose which project resources the key can access. Reach for one when a key needs only a subset of your project, such as executing tools, reading logs, or managing connected accounts.
You pick a key's permissions when you create it, and they can't be changed afterward. To adjust them, create a new key and rotate your application to use it.
Default project API keys keep full project API key access. Scoped keys use the permission areas and access levels on this page.
Create a scoped API key
Create a scoped key from the dashboard:
Go to the Composio Dashboard.
Select Platform.
Select your project.
Go to Settings.
Open the API Keys tab.
Click Create API Key, then choose the permission areas and access levels below.
Access levels
| Access level | What it allows |
|---|---|
| No access | The key cannot use routes in that permission area. |
| Read only | The key can use read routes in that permission area. |
| Write only | The key can use write routes in that permission area. |
| Read and write | The key can use both read and write routes in that permission area. |
Some read routes use POST because the request body carries filters or lookup input. The access level is based on what the route does, not only the HTTP method.
The REST tables show paths relative to the API base URL, with each operation listed once. Use the API reference for the full request URL and endpoint availability. MCP transports use the URL returned when you create a session or MCP server.
Permission areas
Jump to each permission area to see the routes it covers.
| Permission area | Available levels | Routes |
|---|---|---|
| Auth configs | No access, Read only, Write only, Read and write | View routes |
| Connected accounts | No access, Read only, Write only, Read and write | View routes |
| Tools | No access, Read only | View routes |
| Session management | No access, Read only, Write only, Read and write | View routes |
| Session tool execution | No access, Write only | View routes |
| Toolkits | No access, Read only | View routes |
| Triggers | No access, Read only, Write only, Read and write | View routes |
| Webhooks | No access, Read only, Write only, Read and write | View routes |
| Observability | No access, Read only | View routes |
| MCP (Legacy) | No access, Read only, Write only, Read and write | View routes |
| Tool execution (Legacy) | No access, Write only | View routes |
| Proxy execute (Legacy) | No access, Write only | View routes |
Auth configs
View and modify auth configs.
| Access | Method | Route |
|---|---|---|
| Read | GET | /auth_configs |
| Read | GET | /auth_configs/{nanoid} |
| Write | POST | /auth_configs |
| Write | PATCH | /auth_configs/{nanoid} |
| Write | DELETE | /auth_configs/{nanoid} |
| Write | PATCH | /auth_configs/{nanoid}/{status} |
Connected accounts
View and manage connected accounts.
| Access | Method | Route |
|---|---|---|
| Read | GET | /connected_accounts |
| Read | GET | /connected_accounts/{nanoid} |
| Write | POST | /connected_accounts |
| Write | POST | /connected_accounts/link |
| Write | PATCH | /connected_accounts/{nanoid} |
| Write | PATCH | /connected_accounts/{nanoid}/status |
| Write | POST | /connected_accounts/{nanoid}/refresh |
| Write | DELETE | /connected_accounts/{nanoid} |
| Write | POST | /connected_accounts/{nanoid}/revoke |
Tools
View tool definitions, inputs, scopes, and versions.
| Access | Method | Route |
|---|---|---|
| Read | GET | /tools |
| Read | GET | /tools/enum |
| Read | GET | /tools/{tool_slug} |
| Read | GET | /tools/{tool_slug}/get_latest_version |
| Read | GET | /tools/scopes/required |
| Read | GET | /tools/get_scopes_required |
| Read | POST | /tools/execute/{tool_slug}/input |
Session management
Create, view, configure, and delete sessions. This permission does not allow tool execution.
The Session config read routes below are experimental and require Session configs to be enabled for your project.
| Access | Method | Route |
|---|---|---|
| Read | GET | /session_configs |
| Read | GET | /session_configs/{session_config_id} |
| Read | GET | /tool_router/session/{session_id} |
| Read | GET | /tool_router/session/{session_id}/toolkits |
| Read | GET | /tool_router/session/{session_id}/tools |
| Read | GET | /tool_router/session/{session_id}/mounts/{mount_id}/items |
| Read | GET | /tool_router/session/{session_id}/config_history |
| Write | POST | /tool_router/session |
| Write | POST | /tool_router/session/{session_id}/link |
| Write | PATCH | /tool_router/session/{session_id} |
| Write | POST | /tool_router/session/{session_id}/mounts/{mount_id}/upload_url |
| Write | POST | /tool_router/session/{session_id}/mounts/{mount_id}/download_url |
| Write | POST | /tool_router/session/{session_id}/mounts/{mount_id}/delete |
| Write | POST | /tool_router/session/{session_id}/attach |
| Write | DELETE | /tool_router/session/{session_id} |
Session tool execution
Search and execute tools through sessions and session-linked MCP servers. Session proxy execution is not included; grant Proxy execute for that.
| Access | Method | Route |
|---|---|---|
| Write | POST | /tool_router/session/{session_id}/execute |
| Write | POST | /tool_router/session/{session_id}/execute_meta |
| Write | POST | /tool_router/session/{session_id}/search |
For session-linked MCP access, use session.mcp.url and session.mcp.headers unchanged. POST requests require Session tool execution with Write only access. The transport does not support GET (SSE) or DELETE; granting additional permissions does not enable those methods.
Toolkits
View toolkits.
| Access | Method | Route |
|---|---|---|
| Read | GET | /toolkits |
| Read | GET | /toolkits/{slug} |
| Read | GET | /toolkits/categories |
| Read | GET | /toolkits/changelog |
| Read | POST | /toolkits/{toolkit_slug}/scopes/recommended |
| Read | GET | /toolkits/{toolkit_slug}/scopes/grant_context |
| Read | POST | /toolkits/multi |
Triggers
View trigger types, manage trigger instances, and subscribe to trigger events. The realtime routes are called by the SDK (triggers.subscribe()) and the CLI to receive trigger events.
| Access | Method | Route |
|---|---|---|
| Read | GET | /triggers_types |
| Read | GET | /triggers_types/{slug} |
| Read | GET | /triggers_types/list/enum |
| Read | GET | /trigger_instances/active |
| Read | GET | /cli/realtime/credentials |
| Read | POST | /cli/realtime/auth |
| Read | GET | /internal/sdk/realtime/credentials |
| Read | POST | /internal/sdk/realtime/auth |
| Write | POST | /trigger_instances/{slug}/upsert |
| Write | PATCH | /trigger_instances/manage/{triggerId} |
| Write | DELETE | /trigger_instances/manage/{triggerId} |
Webhooks
View and manage webhook endpoints and subscriptions.
| Access | Method | Route |
|---|---|---|
| Read | GET | /webhook_endpoints |
| Read | GET | /webhook_endpoints/{nano_id} |
| Read | GET | /webhook_endpoints/schema |
| Read | GET | /webhook_subscriptions |
| Read | GET | /webhook_subscriptions/{id} |
| Read | GET | /webhook_subscriptions/event_types |
| Write | POST | /webhook_endpoints |
| Write | POST | /webhook_endpoints/{nano_id} |
| Write | PATCH | /webhook_endpoints/{nano_id} |
| Write | DELETE | /webhook_endpoints/{nano_id} |
| Write | POST | /webhook_subscriptions |
| Write | PATCH | /webhook_subscriptions/{id} |
| Write | DELETE | /webhook_subscriptions/{id} |
| Write | POST | /webhook_subscriptions/{id}/rotate_secret |
Observability
View execution logs and project usage summaries.
| Access | Method | Route |
|---|---|---|
| Read | POST | /logs/tool_execution |
| Read | GET | /logs/tool_execution/{id} |
| Read | POST | /project/usage/{entity_type} |
| Read | POST | /project/usage/summary |
MCP (Legacy)
Create, manage, and connect to MCP servers. Transport access grants every capability exposed by the configured MCP server.
| Access | Method | Route |
|---|---|---|
| Read | GET | /mcp/servers |
| Read | GET | /mcp/{id} |
| Read | GET | /mcp/app/{app_key} |
| Read | GET | /mcp/servers/{server_id}/instances |
| Write | POST | /mcp/servers |
| Write | POST | /mcp/servers/generate |
| Write | POST | /mcp/servers/custom |
| Write | PATCH | /mcp/{id} |
| Write | DELETE | /mcp/{id} |
| Write | POST | /mcp/servers/{server_id}/instances |
| Write | DELETE | /mcp/servers/{server_id}/instances/{instance_id} |
For MCP transport access, use the returned MCP server URL unchanged. POST and DELETE requests require MCP (Legacy) with Write only or Read and write access.
Tool execution (Legacy)
Execute predefined Composio tools.
| Access | Method | Route |
|---|---|---|
| Write | POST | /tools/execute/{tool_slug} |
| Write | POST | /files/upload/request |
| Write | POST | /files/upload/response |
| Write | GET | /files/list |
Proxy execute (Legacy)
Execute raw proxy requests against connected accounts.
Proxy execute is separate from tool execution and from Session tool execution. It is the only permission that grants the session proxy route below, whether the call comes from session.proxyExecute() or from code running in that session's sandbox. Grant it only when your application needs to call a connected account API through the raw proxy path.
| Access | Method | Route |
|---|---|---|
| Write | POST | /tools/execute/proxy |
| Write | POST | /tool_router/session/{session_id}/proxy_execute |