Delegated access to Zev products
Scopes by product
How delegated-access permissions are named and approved, and where each product documents its own.
A scope is one permission inside one Zev product, named
<product>.<name>. Each product publishes its own scopes and decides what
they allow.
- Approved per app, per product. ZevID approves the scopes your app may
request on each product. Request only those; anything else is refused at
authorize with
invalid_scope. The console lists them under Delegated access. scopeis the final set. Every authorize sends the full set you want. A permission you leave out is removed from the connection. The only exception isprompt=configurewithoutscope, which keeps the granted permissions and only changes targets.- Some are high risk. Those need a separate approval and a recent sign-in from the user, and they expire. See High-risk permissions.
- Some actions are never grantable. Billing, payments, keys, members, ownership, and deleting a team, workspace, organization or account always stay with the user.
Never read targets from the access token. They come from the token response and webhooks, and the product’s API says how to name the target on each call.
ZevCloud
Targets are teams: the user picks which of their ZevCloud teams your app
may act on, from those they own or administer. Send x-team-id on every call
to https://api.zevcloud.net/v1.
| Scope | Risk | In short |
|---|---|---|
zevcloud.services.read | standard | Read services, deployments, logs and metrics. Environment variable values stay masked. |
zevcloud.services.create | standard | Create projects and services, on free plans only, from a public URL or an upload. From GitHub only with zevcloud.repos.read. |
zevcloud.repos.read | high | Build from your GitHub repositories, which lets it read their code. |
zevcloud.deploy | standard | Deploy, roll back, and start, stop or restart services. |
zevcloud.env.write | standard | Set and delete environment variables, write-only. |
zevcloud.services.delete | high | Delete services your app created, on teams the user owns. |
zevcloud.services.all | high | Act on every service in the team, not only the ones your app created. |
Asking for zevcloud.services.delete narrows which teams a user can pick:
deleting needs the team’s owner, so teams where they are only an admin are
shown but cannot be chosen. Ask for it only if your app deletes services.
More Zev products will accept partners on the same model. Each gets its own table here, linking to its guide.
Updated at, Wednesday, October 21, 2026