Developers
API tokens and scopes
Programmatic access for scripts and CI, and how token scopes limit what a token can do
ReviewDesk has a token-authenticated REST API for automation that does not belong in an AI assistant — a nightly export, a CI check, an internal dashboard.
Scopes
| Scope | Allows |
|---|---|
read | Reading reviews, apps, alerts, and analytics. |
write | Creating and updating — including saving drafts. |
moderate | Publishing replies to a store. |
Scopes are additive and checked per endpoint. A token holding only read cannot save a draft, and one holding read and write can prepare replies but not publish them — a useful split for a script that queues work for a human to release.
Handling tokens safely
- Treat a token like a password — it identifies your organization
- Store it in your CI provider’s secret store, never in a repository
- Use one token per system, so a single one can be revoked without disruption elsewhere
- Rotate when someone with access leaves