Verified BursaPay gateway workflow: Explains the permission scopes available to DeveloperApiKey records.
1. Overview & Purpose
The implemented key scopes include payments:read, payments:write, transfers:write, webhooks:manage, customers:read, customers:write, invoices:read and invoices:write.
2. Requirements & Setup
Choose scopes that match the application task instead of granting unrelated write access.
3. Step-by-Step Workflow
- List the operations the integration needs.
- Map each operation to its required scope.
- Assign the smallest adequate scope set.
- Test an allowed request and an intentionally disallowed request.
4. Rules & Troubleshooting
Scope failures should be handled as authorization errors rather than retried indefinitely.
5. Verification & Next Steps
Review scopes when the integration changes.