Skip to main content

Publish + analytics + ads + comments scoped API keys that exclude private DM/message access

Feature Request

Hi team,

(It's been confirmed there's no current mechanism to exclude inbox data at the account, profile, or key level, and suggested I file this here.)

The request: an API key scope that includes everything Zernio offers — publishing, scheduling, analytics, ads/boosting, and public engagement (comments, reviews, mentions) — except private messages/DMs specifically.

One clarification on scope, Zernio treated "DMs/comments/history" as one bucket ("Inbox data"): I'm not asking to exclude comments, reviews, or mentions — those are public content, and I'd still want API access to them for engagement features. The specific thing I want excludable is private, 1:1-style conversations (DMs) — the messages endpoints, not the comments endpoints. If Inbox is currently modeled as a single resource internally, splitting "messages" out as its own resource type (separate from "comments") is really the core of this request.

Why this matters: I'm building a multi-tenant platform where each of my customers connects their own social accounts. My team-level API key currently has standing access to every connected customer's private DMs by default, whether or not my product ever touches that data. That's a real privacy exposure for a service that's supposed to only be publishing and reporting on their behalf — and it's the one gap keeping me from using Zernio more broadly across my product (including the ads/boosting features, which I'd otherwise like to build on Zernio).

Concretely, either of these would solve it:

- A resource-type dimension on scoped API keys, e.g. `resources: ["posts", "comments", "ads", "analytics"]` that simply omits (private) `"messages"`

- An account/profile-level toggle to disable inbox message ingestion specifically, while leaving comments, reviews, and mentions untouched

Happy to give more detail on the use case if useful. Thanks for considering it.

Posted by Robert B ·
Status: Completed3 comments

Log in to comment and vote

Comments3

  • Miquel Palet López changed status to Completed
    Team•

    Aug 6

    Pinned

    Shipped. When you create an API key there's now an optional "Restrict access" section with a toggle per resource group. Turn off messages and that key gets a 403 on DMs, reads and writes both, while comments, mentions and reviews keep working exactly as you asked. Restricted keys carry a zrk_ prefix, and you can pass disabledResourceGroups to POST /v1/api-keys if you provision programmatically

    Two things that matter for a multi-tenant setup: webhook subscriptions carry the same restrictions, so a no-messages setup doesn't receive message.* payloads, and restricted keys can't mint keys or invite teammates, so a leaked key can't escalate back to full access.

    • Robert B

      •

      Aug 7

      Thank you!

  • Miquel Palet López

    Team•

    Sep 29

    Partly covered now: GET /v1/connect/{platform}?scopes=posting,analytics connects an account without the comments or messaging permissions at all, so no inbox data is ever granted or pulled for it. Docs: https://docs.zernio.com/guides/connecting-accounts#scopes. Scoping an existing API key by area is still open.