{
  "slug": "turso-auth-api-tokens-support-org-wide-scopes-f9efbe92c4cd",
  "title": "turso auth API tokens support org-wide scopes",
  "tools": [
    "turso"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-07T22:40:27.000Z",
  "announced_at": "2026-10-07T22:40:27.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When creating an organization-wide token with explicit permissions, run `turso auth api-tokens mint` with `--org` and one or more `--scope` flags, omitting `--group`. Use `group:create`, `group:delete`, or `org:read` only without `--group`; `--full-access` expands to the group-level scope set.",
    "examples": [
      "turso auth api-tokens mint <token-name> --org <organization-slug> --scope group:create --scope group:delete --scope org:read"
    ],
    "gotchas": [
      "Version: v1.0.34",
      "<token-name> (required): Name of the API token.",
      "--org <organization-slug>: Restricts the token to this organization; omitted value defaults to the selected organization.",
      "--scope <permission>: Repeatable permission scope. Organization-only values: `group:create`, `group:delete`, `org:read`; these are invalid with `--group`.",
      "--read-only: Shorthand scope preset. Mutually exclusive with `--scope` and `--full-access`.",
      "--full-access: Shorthand for full access; mutually exclusive with `--scope` and `--read-only`. Its scope set is group-level only.",
      "--group <group>: Restricts token to a group within `--org`; requires at least one scope and rejects organization-level scopes. Omit for an organization-wide token.",
      "Prerequisite: The CLI obtains an authenticated Turso client before minting the token; authenticate with `turso auth login` if needed.",
      "The org-level scopes `group:create`, `group:delete`, and `org:read` are rejected with `--group`.",
      "The `full-access` label matches the group-level set only, as the platform expands it.",
      "Docs conflict: Current Turso CLI docs list `--scope` as group-scoped and omit the organization-level scope values, differing from the v1.0.34 release behavior. https://github.com/tursodatabase/turso-docs/blob/main/cli/auth/api-tokens/mint.mdx"
    ]
  },
  "why_it_matters": "Create or review an organization-wide API token with explicit permissions.",
  "sources": [
    "https://github.com/tursodatabase/turso-cli/releases/tag/v1.0.34",
    "https://github.com/tursodatabase/turso-cli/pull/1071",
    "https://github.com/tursodatabase/turso-cli/blob/v1.0.34/internal/cmd/auth_createapitokens.go",
    "https://github.com/tursodatabase/turso-cli/blob/v1.0.34/internal/turso/apitoken_scope.go"
  ],
  "rank": 0.96037,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-07ee91a4791c4161-0:gate",
    "evidence_hash": "3ca76b3ef7dff73f9cd4a4b1758912bceb419915ce89677a225dd1f8835a87d8"
  },
  "review": {
    "draft_hash": "f8353bbedd9fbf7bccc8bb4ebc598ee27aeb948cf9247309605338a1574964de",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T22:40:27.000Z",
    "decision": "wave2b-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.71 (>= 0.6 needed)."
  }
}