---
title: "Authentication and scopes"
description: "Bearer API keys, scopes, IP allow lists and how keys only see your own objects."
url: https://www.gyrohosting.com/developers/en/guides/auth.html
language: en
openapi: https://www.gyrohosting.com/developers/openapi.json
api_version: 2.30.0
---

# Authentication and scopes

Every request carries `Authorization: Bearer wck_…` (or `X-Api-Key`). Keys belong to your account
and can only see your own objects; anything else answers `404`, exactly like an id that does not exist.

| Scope | Allows |
|---|---|
| `Module:Addons/GyroAPI/cloud_read` | All GET endpoints under `/cloud` |
| `…/cloud_write` | Power, rebuild, snapshots, rDNS, rename, SSH keys |
| `…/cloud_order` | **Spends money**: create servers (paid from balance) |
| `…/cloud_delete` | Cancel / delete servers |
| `Invoices/GetInvoices`, `Invoices/GetInvoice`, `Balance/GetBalance` | Billing reads |

Give CI pipelines the smallest set they need and an IP allow list. Revoke a key in the client area at any time.