API Tokens & RBAC: Secure Developer Access

Generate scoped API tokens with role-based permissions. Control integration access, rotate keys safely, and monitor usage. Enterprise security standards.

SendSeven combines role-based access control with personal API tokens. Ten built-in roles plus custom roles draw on 78 permission scopes across 17 resource types, so access matches the job. API tokens belong to individual accounts and stay invisible to the rest of the team. Login with SendSeven adds OIDC sign-in to your own app.

Traditional role-based systems (Owner, Admin, Agent, Viewer) are too rigid for modern teams. Organizations need granular permission control, API tokens with specific scopes, and the ability to assign multiple roles to users. Security teams require audit trails and privilege escalation prevention.

SendSeven implements OAuth2-style scope-based RBAC with 78 granular permissions across 17 resources. Create scoped API tokens, assign multiple roles to users, and track all permission changes with comprehensive audit logging. Wildcard matching and privilege escalation prevention ensure enterprise-grade security.

78 granular scopes (conversations:read, campaigns:create, etc.)

10 system roles (OWNER, ADMIN, MARKETING_AGENT, SUPPORT_AGENT, etc.)

Multi-role support - users can have multiple roles

Wildcard scope matching (*:*, campaigns:*, *:read)

Manage team permissions and API tokens from the Settings page. Assign roles, create tokens, and track access.

Navigate to Settings > Team. Your current scopes are listed. System admins can see all 78 available scopes.

In Settings > Team, click a user. Click "Edit Roles" and select from 10 system roles. Users can have multiple roles (e.g., MARKETING_AGENT + SUPPORT_AGENT).

Navigate to Settings > API Tokens. Click "Create Token", give it a name, select scopes (e.g., conversations:read, messages:write), and optionally set an expiration date.

The token is shown ONLY ONCE on creation (e.g., s7_api_a1b2c3d4e5f6...). Copy it immediately and store it securely. You cannot retrieve it later.

In Settings > API Tokens, you can revoke a token (permanent) or regenerate it (creates new token, invalidates old one).

Programmatically manage roles, permissions, and API tokens with 29 RBAC endpoints.

Create a token with specific permissions

Authenticate with scoped token instead of JWT

Give user both marketing and support permissions