Understanding API Key Scopes

[mcc-admin-101]

Hi folks! I have created a gateway and a group, and I'm successfully uploading files and I see them in the group.

However, I'm using and API Key which has Admin permission. If I create an API Key called "AllExceptAdmin" and give it all permissions except the Admin one, I get a 401 Unauthorized. Doesn't seem right from a least privs perspective?

[mcc-admin-101]

this is the code I'm using ...

const groupId = process.env.PINATA_GROUP_ID;

const { cid } = await pinata.upload.public
  .json(payload)
  .name(payloadName)
  .group(groupId);
const url = await pinata.gateways.public.convert(cid);

[stevedylandev]

Hey there! You are on the right track; you caught us in a transition phase 🙈 The SDK you're using currently uses the V3 API Routes however our UI is still being updated to provide the new scopes for these routes. If you want to make one now you can do so through the docs here, and as far as what routes fall under what scopes, we have the scopes listed underneath the name of each endpoint.

Apologies for any confusion this might have caused! The App UI should be updated shortly :)