Skip to main content
An API key works through the role selected when the key is created. If the role does not include the required permission, Plato returns an authorization error even when the key itself is valid.

​
Common Permission Sets

Use this as a starting point when creating a role for an integration.
API areaRequired access
CMS read and writeCMS app access
Connect360 readconnect360:conversation:read
Connect360 send or createconnect360:conversation:engage
Connect360 deleteconnect360:conversation:delete
Restaurant order feedrestaurant:order:read
Form read or submitAPI key access to the workspace that owns the form
Menu products and categoriesAPI key access to the workspace that owns the menu data
Create one role per integration type. For example:
  • Website CMS Reader for a marketing site that only reads CMS entries.
  • Website Chat Connector for Connect360 chat messages and attachments.
  • Accounting Order Export for a tool that reads restaurant order totals.
This keeps every API key easy to audit.

​
Full Access

fullAccess works, but it should not be the default for integrations. Use it only when a trusted backend truly needs broad workspace access and the key is stored securely.

​
Permission Errors

When permissions are missing, responses commonly include messages like: 
{
  "message": "Missing permission: appAccess:CMS"
}
or: 
{
  "message": "Unauthorized API key permissions."
}
If this happens, check the role attached to the API key before creating a new key.