# Authentication
Source: https://nordvec.com/docs/guides/authentication#scopes

## Scopes [#scopes]

A key carries one or more scopes, and an operation answers `403` to a key
without the scope it needs. A key can only carry scopes of its own class.

| Scope | Class | Allows |
| --- | --- | --- |
| `search:read` | Client | Search, list, fetch and batch-fetch documents |
| `quota:read` | Client | Embedding quota and usage analytics |
| `audit:read` | Client | Search the workspace's audit trail and read its event catalogue |
| `index:write` | Indexing | Push and bulk-push documents, update their permissions |
| `index:delete` | Indexing | Delete pushed documents |
| `index:status` | Indexing | Push status and ingestion health |
| `index:acl-widen` | Indexing | Make an already-restricted document visible to the whole workspace. A key with this scope must have an expiry |

Give each key the fewest scopes its job needs, so a leaked key can do as
little as possible.