API permissions

Every credential carries a set of permissions, and it can only do what they allow. You choose them in two places, and they mean the same thing in both:

  • when you create an API key on your API page, and
  • when an AI assistant connects over the MCP endpoint and asks for your consent.

Give a credential the least it needs. A reporting script that only reads rankings has no business holding a key that can also export your earnings, and if that key leaks the difference is what you lose.

The permissions

Read — appbrain:read

Read your keyword rankings, competitors and app data.

Everything that only looks at data: keyword rankings and their history, your tracked keywords and competitors, Google Play and App Store app information, top charts, developer portfolios, SDK and library statistics, device statistics, and app-ads.txt validation.

This is the permission almost every integration needs, and for a read-only one it is the only permission to give.

Keyword changes — appbrain:keywords:write

Track and untrack keywords, and generate keyword reports.

Anything that changes your keyword setup: adding and removing tracked keywords, adding and removing competitors, and asking for a keyword report to be generated. It changes what AppBrain collects for you, and tracked keywords count against your plan’s quota, so a credential with this permission can use up that quota.

It does not grant anything the Read permission does not already cover: a credential that may change tracked keywords still needs Read to see them.

Report export — appbrain:reports:export

Export your earnings, billing and promotion reports.

Downloading your own reporting data as CSV: ad earnings, billing, and promotion campaign performance. This is the financially sensitive one, which is why it is separate rather than part of Read, and why we suggest leaving it off unless the integration is your own reporting pipeline.

What they do not cover

Permissions control what a credential may do. They do not change:

  • Your subscription. AppBrain Intelligence data stays gated on your subscription whatever permissions a key has. See pricing.
  • Your API credits. Every credential on an account spends the same monthly credit allowance, so permissions limit the blast radius, not the bill.
  • Your own apps. Calls about apps you own are free and always readable.

Changing your mind

You can revoke an API key at any time on the API page; anything using it stops working immediately. Revoking is permanent, so an integration that needs access again gets a new key.

For an AI assistant, the account’s API page lists every connection that can reach the account, including ones other users of the account made, and you can disconnect any of them. Your own connections are also on your connected applications page, where you can change which accounts and permissions a connection has without disconnecting it.