API keys and scopes

Grant each key only the scopes it needs.

Scope	Grants
`notes:read`	Read notes, notebooks, tags, templates and shares.
`notes:write`	Create, change and delete the objects above.
`files:read`	Download attachments.
`files:write`	Upload and delete attachments.
`sync`	Use the sync endpoints.
`profile`	Read and update the current user.
`members:write`	Manage members and invitations.
`webhooks:read`	List webhooks and deliveries.
`webhooks:write`	Create and change webhooks.
`keys:write`	Create and rotate API keys.
`usage:read`	Read usage counters.
`audit`	Read the audit log.

Rotation

Use POST /api-keys/{id}/rotate to issue a new secret. The previous secret keeps working for 24 hours so you can deploy without downtime.