Permission scopes

Crispy has two permission layers: an account-level tool scope, and per-key permissions on API keys.

Account tool scope

Every LinkedIn account has a permission scope of 'core' or 'full_access'. Core is the default for all new accounts and covers the complete daily loop: messaging, outreach, content, campaigns, lists, and analytics. Full access adds advanced tooling such as webhook management, API key management, and irreversible extras like deleting posts.

Change it with update_account_settings by passing permission_scope. The new tool list takes effect after you reconnect your MCP client.

API key permissions

Each API key can be restricted independently when you create it with create_api_key:

• scope: 'team', 'workspace', or 'resource' controls which data the key can reach
• permissions: a list like ['campaigns:read', 'inbox:write'] controls which actions it can perform

Available permissions cover campaigns, inbox, connections, content, analytics, webhooks, and key management, split into read and write where applicable. Omit the permissions list for a full-access key. Pass an empty list for a locked-down key that can do nothing until you grant permissions. A key with only read permissions is safe to hand to reporting tools and dashboards.

Keys are limited to 10 per account, and the raw key value is shown exactly once at creation, so store it securely. Revoke a key at any time from the dashboard or with revoke_api_key; revoking signs out anything that was using it.

For teams, give each member and each integration the minimum it needs: read-only keys for analysts, inbox and campaign write access for whoever runs outreach, and full access only for the account owner.