tapimo 0.4.1 → 0.4.4

package/src/apps/data/routes/funding.ts

@@ -41,7 +41,7 @@ export namespace schema {
         .optional(z.record(z.string(), z.string()))
         .check(
           z.describe('Provider-specific chain ids Tempo uses when querying route providers.'),
-          z.meta({ examples: [{ across: '8453', relay: '8453' }] }),
+          z.meta({ examples: [{ bridge: 'base', relay: '8453' }] }),
         ),
     }),
     'A normalized chain reference for funding routes.',
@@ -122,7 +122,7 @@ export namespace schema {
   /** Provider summary embedded in a route candidate. */
   export const ProviderRef = Schema.describe(
     z.object({
-      id: z.string().check(z.describe('Stable provider id.'), z.meta({ examples: ['across'] })),
+      id: z.string().check(z.describe('Stable provider id.'), z.meta({ examples: ['relay'] })),
       kind: z
         .string()
         .check(
@@ -131,7 +131,7 @@ export namespace schema {
         ),
       name: z
         .string()
-        .check(z.describe('Human-readable provider name.'), z.meta({ examples: ['Across'] })),
+        .check(z.describe('Human-readable provider name.'), z.meta({ examples: ['Relay'] })),
       requiresApiKey: z
         .boolean()
         .check(
@@ -283,7 +283,7 @@ export namespace schema {
         .string()
         .check(
           z.describe('Stable deterministic route candidate id.'),
-          z.meta({ examples: ['base-usdc-tempo-usdce-across'] }),
+          z.meta({ examples: ['base-usdc-tempo-usdce-relay'] }),
         ),
       provider: ProviderRef,
       quality: Quality,
@@ -369,9 +369,9 @@ export namespace schema {
           .optional(z.string())
           .check(
             z.describe(
-              'Only return candidates from this provider id, such as `across`, `relay`, or `bridge`. Planned providers can return an empty list.',
+              'Only return candidates from this provider id, such as `relay`, `bridge`, or `bungee`. Planned providers can return an empty list.',
             ),
-            z.meta({ examples: ['across', 'bridge'] }),
+            z.meta({ examples: ['relay', 'bridge'] }),
           ),
         sourceAmount: z
           .string()
@@ -463,12 +463,12 @@ export namespace schema {
 const fundingRouteResponseExamples = {
   baseUsdc: {
     description:
-      '`GET /v1/funding/routes?sourceChain=base&sourceToken=USDC&sourceAmount=1000000&provider=across`',
+      '`GET /v1/funding/routes?sourceChain=base&sourceToken=USDC&sourceAmount=1000000&provider=relay`',
     summary: 'Base USDC',
     value: {
       data: FundingRoutes.listStaticRoutes({
         limit: 10,
-        provider: 'across',
+        provider: 'relay',
         sourceAmount: '1000000',
         sourceAmountUnits: 'baseUnits',
         sourceChain: 'base',

package/src/apps/data/routes/indexer.test.ts

@@ -131,14 +131,14 @@ describe('GET /indexer/query', () => {
     const app = TestApp.create({
       rateLimit: { store: rateLimitStore },
       mpp: {
-        charge: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
           chainId: Tempo.chain.id,
           currency: Tempo.currency,
           decimals: 6,
           getClient: () => Tempo.client,
           recipient: Tempo.accounts[2].address,
         },
-        secretKey: 'secret_test_key_0123456789abcdef',
       },
     })
     await exhaustQuota(RateLimit.memory({ store: rateLimitStore }), 'public:anonymous', {

package/src/apps/data/routes/webhooks.test.ts

@@ -1100,14 +1100,14 @@ describe('MPP access (disabled for now — API-key-only)', () => {
     const app = TestApp.create({
       auth: { keys: [] },
       mpp: {
-        charge: {
+        secretKey: 'secret_test_key_0123456789abcdef',
+        session: {
           chainId: Tempo.chain.id,
           currency: Tempo.currency,
           decimals: 6,
           getClient: () => Tempo.client,
           recipient: Tempo.accounts[2].address,
         },
-        secretKey: 'secret_test_key_0123456789abcdef',
       },
     })
 

package/src/apps/management/App.ts

@@ -87,8 +87,8 @@ export type Environment = {
  * invitations, and API-key management. Every route reads its dependencies from
  * request context set by {@link App.create}.
  *
- * The session-auth surface (`/v1/auth/siwe` + `session` capability) is owned by
- * {@link App.create}, so management routes gate on a session without owning it.
+ * The session-auth surface is owned by {@link App.create}; management routes
+ * reference it alongside scoped API-key access.
  *
  * ```ts
  * App.create(options).route('/', management())

package/src/apps/management/Billing.ts

@@ -7,6 +7,7 @@ import type * as BillingSettings from '../../db/tables/billingSettings.js'
 import * as Db from '../../db/Db.js'
 import * as Fees from '../../internal/Fees.js'
 import * as RequestUsage from '../../db/tables/requestUsage.js'
+import type * as Scope from '../../Scope.js'
 import * as SponsoredTransactions from '../../db/tables/sponsoredTransactions.js'
 import * as StripeCustomers from '../../db/tables/stripeCustomers.js'
 import * as Viem from '../../internal/Viem.js'
@@ -641,7 +642,7 @@ export async function listActive(
 export function createKeyBillingSyncer(
   options: createKeyBillingSyncer.Options,
 ): createKeyBillingSyncer.Syncer {
-  const { db, environments = ['sandbox'], kv } = options
+  const { db, environments = ['sandbox'], kv, scopeCatalog } = options
   return {
     async tick() {
       // Resolve per tick so Workers factories build a fresh Hyperdrive-pooled
@@ -655,7 +656,12 @@ export function createKeyBillingSyncer(
           checked += 1
           // `setBillingActive` writes only drifted records, so a converged
           // fleet costs list reads and no writes.
-          updated += await ApiKeys.setBillingActive(kv, { active, environment, orgId })
+          updated += await ApiKeys.setBillingActive(kv, {
+            active,
+            environment,
+            orgId,
+            scopeCatalog,
+          })
         }
       }
       return { checked, updated }
@@ -672,6 +678,8 @@ export declare namespace createKeyBillingSyncer {
     environments?: readonly StripeCustomers.Record['environment'][] | undefined
     /** KV state store holding API-key records. */
     kv: Store.State
+    /** Scope catalog accepted while reconciling API-key records. */
+    scopeCatalog?: Scope.Catalog | undefined
   }
 
   /** A scheduled snapshot-reconcile job. */

package/src/apps/management/routes/api-keys.test.ts

@@ -1,8 +1,13 @@
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
 
 import * as ApiKeys from '../../../ApiKeys.js'
+import * as Auth from '../../../internal/Auth.js'
+import * as OpenApi from '../../../internal/OpenApi.js'
+import * as Scope from '../../../Scope.js'
 import * as TestApp from '../../../../test/App.js'
+import * as Memberships from '../../../db/tables/memberships.js'
 import * as Keys from './api-keys.js'
+import * as Me from './me.js'
 import * as Orgs from './orgs.js'
 import * as Projects from './projects.js'
 
@@ -33,10 +38,18 @@ function superAdminJson(method: 'PATCH' | 'POST', body: unknown) {
 // Resolve-cache disabled so revocation assertions observe the store directly.
 type State = ReturnType<typeof TestApp.kvStore>
 
-function createApp(options: { kv?: { store: State } } = {}) {
+function createApp(
+  options: {
+    db?: ReturnType<typeof TestApp.database>
+    kv?: { store: State }
+    scopes?: readonly Scope.Entry[]
+  } = {},
+) {
   return TestApp.create({
     auth: { cache: false, superAdmin: { secret } },
+    db: options.db ?? TestApp.database(),
     ...(options.kv ? { kv: options.kv } : {}),
+    ...(options.scopes ? { scopes: options.scopes } : {}),
     session: { wallet: { origin } },
   })
 }
@@ -70,6 +83,77 @@ async function fixture(app: ReturnType<typeof createApp>, cookie: string) {
 }
 
 describe('keys', () => {
+  test('requires an owner to issue management write keys', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const owner = await session(app)
+    const { org, project } = await fixture(app, owner)
+    const admin = await session(app)
+    const user = await TestApp.json(
+      await app.request('/v1/me', { headers: { cookie: admin } }),
+      Me.schema.User,
+    )
+    await Memberships.create(db, {
+      orgId: org.id,
+      role: 'admin',
+      userId: user.id,
+    })
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+
+    const read = await app.request(base, json('POST', admin, { scopes: ['management:read'] }))
+    expect(read.status).toBe(200)
+
+    const denied = await app.request(base, json('POST', admin, { scopes: ['management:write'] }))
+    expect(denied.status).toBe(403)
+    expect(await denied.json()).toMatchObject({ error: { code: 'scope_not_issuable' } })
+
+    const write = await app.request(base, json('POST', owner, { scopes: ['management:write'] }))
+    expect(write.status).toBe(200)
+  })
+
+  test('lets management keys manage org credentials without delegating issuance', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+    const other = await TestApp.json(
+      await app.request(`/v1/orgs/${org.id}/projects`, json('POST', cookie, { name: 'Payments' })),
+      Projects.schema.Project,
+    )
+    const base = `/v1/orgs/${org.id}/projects/${project.id}/api-keys`
+    const siblingBase = `/v1/orgs/${org.id}/projects/${other.id}/api-keys`
+    const manager = await TestApp.json(
+      await app.request(
+        base,
+        superAdminJson('POST', {
+          scopes: ['management:read', 'management:write'],
+        }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    const target = await TestApp.json(
+      await app.request(siblingBase, superAdminJson('POST', { scopes: ['data:read'] })),
+      Keys.schema.createApiKey.Response,
+    )
+
+    const listed = await app.request(siblingBase, {
+      headers: { 'tempo-api-key': manager.token },
+    })
+    expect(listed.status).toBe(200)
+
+    const delegated = await app.request(base, {
+      body: JSON.stringify({ scopes: ['management:read'] }),
+      headers: { 'content-type': 'application/json', 'tempo-api-key': manager.token },
+      method: 'POST',
+    })
+    expect(delegated.status).toBe(403)
+
+    const revoked = await app.request(`${siblingBase}/${target.id}`, {
+      headers: { 'tempo-api-key': manager.token },
+      method: 'DELETE',
+    })
+    expect(revoked.status).toBe(200)
+  })
+
   test('mints, lists, authenticates, and revokes a project key', async () => {
     const app = createApp()
     const cookie = await session(app)
@@ -187,6 +271,58 @@ describe('keys', () => {
     expect(created.createdBy).not.toBe('super_admin')
   })
 
+  test('mints and authenticates host scopes', async () => {
+    const app = createApp({
+      scopes: [
+        {
+          description: 'Read project accounts.',
+          scope: 'accounts:read',
+          selfServe: true,
+        },
+      ],
+    }).get(
+      '/custom/accounts',
+      Auth.policy({ apiKey: { scopes: ['accounts:read'] } }),
+      OpenApi.describeRoute({
+        operationId: 'getCustomAccounts',
+        responses: { 200: { description: 'Custom accounts response.' } },
+        summary: 'Get custom accounts',
+      }),
+      (c) => c.json({ ok: true }, 200),
+    )
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const created = await TestApp.json(
+      await app.request(
+        `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+        json('POST', cookie, { scopes: ['accounts:read'] }),
+      ),
+      Keys.schema.createApiKey.Response,
+    )
+    const response = await app.request('/custom/accounts', {
+      headers: { 'tempo-api-key': created.token },
+    })
+
+    expect(created.scopes).toEqual(['accounts:read'])
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ ok: true })
+  })
+
+  test('rejects unregistered host scopes', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const { org, project } = await fixture(app, cookie)
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/projects/${project.id}/api-keys`,
+      superAdminJson('POST', { scopes: ['accounts:read'] }),
+    )
+
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+  })
+
   test('rejects session mints of non-self-serve scopes (webhooks)', async () => {
     const app = createApp()
     const cookie = await session(app)

package/src/apps/management/routes/api-keys.ts

@@ -53,11 +53,11 @@ export namespace schema {
           z.meta({ examples: ['org_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
         ),
       projectId: z.optional(z.string()).check(
-        z.describe('Owning project id (`prj_…`).'), // prettier-ignore
+        z.describe('Attributed project id (`prj_…`).'), // prettier-ignore
         z.meta({ examples: ['prj_1a2b3c4d5e6f7g8h9j0k1m2n'] }),
       ),
       scopes: z
-        .array(z.enum([...Scope.catalog.map((entry) => entry.scope), Scope.wildcard]))
+        .array(z.string().check(z.minLength(1)))
         .check(
           z.describe(
             "Granted scopes. '*' (grant-all) appears only on keys minted by the super admin.",
@@ -138,7 +138,15 @@ export namespace schema {
         .optional(z.string().check(z.minLength(1), z.maxLength(100)))
         .check(z.describe('Human-readable key name.'), z.meta({ examples: ['CI'] })),
       scopes: z
-        ._default(z.array(z.enum(Scope.catalog.map((entry) => entry.scope))), [])
+        ._default(
+          z.array(
+            z.string().check(
+              z.minLength(1),
+              z.refine((scope) => scope !== Scope.wildcard),
+            ),
+          ),
+          [],
+        )
         .check(z.describe('Scopes to grant.'), z.meta({ examples: [['data:read']] })),
     })
     .check(z.describe('Fields for minting an API key.'))
@@ -210,11 +218,7 @@ export namespace schema {
 }
 
 /**
- * Mounts the `/orgs/:orgId/projects/:projectId/api-keys` resource
- * (project-scoped mint/list/revoke) plus the org-wide read
- * `/orgs/:orgId/api-keys`, over the KV state store. Access follows the
- * org/project scope (owning session or super admin); the token appears once,
- * at mint.
+ * Mounts project-attributed API key mint, list, and revoke routes plus the org-wide list. Access follows the caller's organization ownership.
  */
 export function apiKeys(options: apiKeys.Options = {}) {
   const hidden = !options.enabled
@@ -233,7 +237,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
         message: 'Check the request body and try again.',
       }),
       OpenApi.describeRoute({
-        description: 'Mint a project-scoped API key. The token appears once and is never shown again.', // prettier-ignore
+        description: 'Mint a project-attributed API key. The token appears once and is never shown again.', // prettier-ignore
         hide: hidden,
         operationId: 'createApiKey',
         responses: OpenApi.responses({
@@ -273,20 +277,19 @@ export function apiKeys(options: apiKeys.Options = {}) {
 
         const body = c.req.valid('json')
 
-        // Sessions mint only self-issuable scopes; the super admin grants the
-        // full catalog. Self-serve covers the whole catalog now that billing
-        // ships, so this is a safety net: a future non-self-serve scope would
-        // be refused here without further changes.
-        if (createdBy !== 'super_admin') {
-          const denied = body.scopes.filter((scope) => !Scope.selfServe.includes(scope))
-          if (denied.length > 0)
-            return Response.error(c, {
-              code: 'scope_not_issuable',
-              message: 'The requested scopes are not issuable.',
-              status: 403,
-            })
-        }
+        if (!body.scopes.every((scope) => Scope.includes(c.get('scopeCatalog'), scope)))
+          return Response.error(c, {
+            code: 'body_invalid',
+            message: 'Check the request body and try again.',
+            status: 400,
+          })
 
+        if (!canIssue(c, body.scopes))
+          return Response.error(c, {
+            code: 'scope_not_issuable',
+            message: 'The requested scopes are not issuable.',
+            status: 403,
+          })
         try {
           const orgId = Auth.org(c).id
           // Snapshot billing onto the record so the auth path throttles a
@@ -296,15 +299,19 @@ export function apiKeys(options: apiKeys.Options = {}) {
             body.environment === 'sandbox'
               ? await Billing.active(Db.get(c.get('db')), orgId, 'sandbox')
               : undefined
-          const { record, token } = await ApiKeys.mint(kv.store, {
-            createdBy,
-            environment: body.environment,
-            ...(billingActive === undefined ? {} : { billingActive }),
-            ...(body.name === undefined ? {} : { name: body.name }),
-            orgId,
-            projectId: Auth.project(c).id,
-            scopes: body.scopes,
-          })
+          const { record, token } = await ApiKeys.mint(
+            kv.store,
+            {
+              createdBy,
+              environment: body.environment,
+              ...(billingActive === undefined ? {} : { billingActive }),
+              ...(body.name === undefined ? {} : { name: body.name }),
+              orgId,
+              projectId: Auth.project(c).id,
+              scopes: body.scopes,
+            },
+            { scopeCatalog: c.get('scopeCatalog') },
+          )
           return c.json(
             Response.validated(schema.createApiKey.Response, { ...serializeKey(record), token }),
             200,
@@ -316,7 +323,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
     )
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       Auth.ensureProject(),
       OpenApi.validate('param', schema.Params, {
@@ -344,7 +351,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
         tags: ['API Keys'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureProjectError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -363,6 +370,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
           const records = await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
             environment: c.req.valid('query').environment,
             projectId: Auth.project(c).id,
+            scopeCatalog: c.get('scopeCatalog'),
           })
           return c.json(
             Response.validated(schema.listApiKeys.Response, {
@@ -377,7 +385,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
     )
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/api-keys',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.OrgParams, {
         code: 'param_invalid',
@@ -405,7 +413,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
         tags: ['API Keys'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -423,6 +431,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
         try {
           const records = await ApiKeys.listByOrg(kv.store, Auth.org(c).id, {
             environment: c.req.valid('query').environment,
+            scopeCatalog: c.get('scopeCatalog'),
           })
           return c.json(
             Response.validated(schema.listOrgApiKeys.Response, {
@@ -437,7 +446,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
     )
     .delete(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/projects/:projectId{prj_[A-Za-z0-9_-]+}/api-keys/:keyId{key_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'admin' }),
       Auth.ensureProject(),
       OpenApi.validate('param', schema.KeyParams, {
@@ -459,7 +468,7 @@ export function apiKeys(options: apiKeys.Options = {}) {
         tags: ['API Keys'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureProjectError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -473,7 +482,9 @@ export function apiKeys(options: apiKeys.Options = {}) {
         try {
           // Bind the key to the scoped project before revoking: a key id from
           // another org or project must be indistinguishable from a missing one.
-          const record = await ApiKeys.get(kv.store, keyId)
+          const record = await ApiKeys.get(kv.store, keyId, {
+            scopeCatalog: c.get('scopeCatalog'),
+          })
           if (!record || record.orgId !== Auth.org(c).id || record.projectId !== Auth.project(c).id)
             return keyNotFound(c)
           const revoked = await ApiKeys.revoke(kv.store, keyId)
@@ -518,6 +529,20 @@ function mintedBy(c: Context<App.Environment>) {
   return undefined
 }
 
+/** Checks whether the caller may grant every requested scope. */
+function canIssue(c: Context<App.Environment>, scopes: readonly Scope.Id[]) {
+  const principal = Auth.getPrincipal(c)
+  if (principal?.type === 'super_admin') return true
+  if (principal?.type === 'session') {
+    const selfServe = Scope.selfServeFrom(c.get('scopeCatalog'))
+    return (
+      scopes.every((scope) => selfServe.includes(scope)) &&
+      (!scopes.includes('management:write') || Auth.membership(c)?.role === 'owner')
+    )
+  }
+  return false
+}
+
 function keyNotFound(c: Context<App.Environment>) {
   return Response.error(c, {
     code: 'api_key_not_found',

package/src/apps/management/routes/billing.ts

@@ -234,14 +234,13 @@ export namespace schema {
 }
 
 /**
- * Mounts the billing surface: an organization's billing status. Orgs without
- * a Stripe billing source read as `none`. Session lane; reads for members.
+ * Mounts billing routes. Reads require membership or scoped API key access; organizations without Stripe state return `none`.
  */
 export function billing() {
   return new Hono<Environment>()
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/billing',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -264,7 +263,7 @@ export function billing() {
         tags: ['Billing'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -294,7 +293,7 @@ export function billing() {
     )
     .patch(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/billing',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'owner' }),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -325,7 +324,7 @@ export function billing() {
         tags: ['Billing'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -381,7 +380,7 @@ export function billing() {
     )
     .post(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/billing/stripe/checkout',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'owner' }),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -408,7 +407,7 @@ export function billing() {
         tags: ['Billing'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -466,7 +465,7 @@ export function billing() {
     )
     .post(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/billing/stripe/manage',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'owner' }),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -493,7 +492,7 @@ export function billing() {
         tags: ['Billing'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -529,7 +528,7 @@ export function billing() {
     )
     .get(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/billing/payment-methods',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:read'] }, session: true }),
       Auth.ensureOrg(),
       OpenApi.validate('param', schema.Params, {
         code: 'param_invalid',
@@ -555,7 +554,7 @@ export function billing() {
         tags: ['Billing'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -615,7 +614,7 @@ export function billing() {
     )
     .delete(
       '/v1/orgs/:orgId{org_[A-Za-z0-9_-]+}/billing/payment-methods/:methodId{pm_[A-Za-z0-9_-]+}',
-      Auth.policy({ session: true }),
+      Auth.policy({ apiKey: { scopes: ['management:write'] }, session: true }),
       Auth.ensureOrg({ role: 'owner' }),
       OpenApi.validate('param', schema.MethodParams, {
         code: 'param_invalid',
@@ -642,7 +641,7 @@ export function billing() {
         tags: ['Billing'],
       }),
       async (c) => {
-        if (Auth.narrowAccess) return Auth.superAdminAccessError(c)
+        if (Auth.narrowAccess) return Auth.accessError(c)
         if (Auth.narrowScope) return Auth.ensureOrgError(c)
         if (OpenApi.narrowValidation)
           return OpenApi.validationError(c, {
@@ -797,6 +796,7 @@ async function syncKeyBilling(
     active: options.status === 'active',
     environment: 'sandbox',
     orgId: options.orgId,
+    scopeCatalog: c.get('scopeCatalog'),
   })
 }