Skip to content
1 minute readSecurityAgent-ready

Give API keys explicit checkout-session permission

Use commerce:checkout for keys that need to create or change UCP checkout sessions.

The API reference for creating a UCP checkout session, describing the commerce:checkout permission that starting or changing a checkout takes.

Keys that manage UCP checkout sessions need commerce:checkout. Quote-only keys should keep the narrower pricing permission.

  • Creating, changing or cancelling a session requires the checkout scope. A key without it receives 403 insufficient_scope.
  • Quotes still require price:compute; keys with either relevant scope can read sessions.
  • Keys with no explicit scopes, * or commerce:* retain their existing broad access. To narrow access, create a replacement key with the intended scopes and retire the old one.

Payment completion remains unavailable: the completion operation returns 501 payment_not_configured. Checkout-session permission does not enable a purchase.