Scopes

You pick the permissions per key.

Scope	What it grants
meetings:read	Read meetings, minutes and participants
meetings:write	Create meetings, which starts a bot — phase 2, no endpoint yet
transcripts:read	Read transcripts
action_items:read	Read tasks, per meeting or across meetings
action_items:write	Edit tasks — phase 2, no endpoint yet
uploads:write	Upload recordings, which starts a transcription. Personal keys only, and only when the person picks it

Two of the write scopes, meetings:write and action_items:write, exist in the data model but have no route behind them. A key that carries one of them can do nothing with it. Which scope an endpoint needs is on the endpoint's own page, next to its address.

What a personal key can carry

A personal key carries the three read scopes. Write access stays with an admin's account key: a personal key should hand out data, not start recordings and run up cost.

There is one exception, and the person has to choose it on purpose when creating the key: uploads:write. It lets a script or a Shortcut upload a recording (how it works). An upload starts a transcription, which uses quota, so the scope is never preselected. It belongs to a person, who owns the meeting and needs a recording licence, so an account key cannot carry it.