scope_exceeds_creator

# Your own key's scopes: match its first 13 characters against secret_prefix.
curl -s https://api.opentype.dev/v1/keys \
  -H "Authorization: Bearer $OPENTYPE_API_KEY" \
  | jq --arg p "${OPENTYPE_API_KEY:0:13}" '.keys[] | select(.secret_prefix == $p) | .scopes'

curl https://api.opentype.dev/v1/keys \
  -H "Authorization: Bearer $OPENTYPE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "ops-dashboard", "scopes": ["runs_write", "runs_read", "billing_write"]}'

const requested = ["runs_write", "runs_read", "billing_write"];

const res = await fetch("https://api.opentype.dev/v1/keys", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.OPENTYPE_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ name: "ops-dashboard", scopes: requested }),
});

const body = await res.json();
if (res.status === 403 && body.error.code === "scope_exceeds_creator") {
  // The message names the scope you do not hold, e.g. "... the scope billing_write".
  throw new Error(`Drop the scope or ask an admin: ${body.error.message}`);
}
if (!res.ok) throw new Error(`${body.error.code}: ${body.error.message}`);
console.log(body.id);

import os
import requests

requested = ["runs_write", "runs_read", "billing_write"]

resp = requests.post(
    "https://api.opentype.dev/v1/keys",
    headers={"Authorization": f"Bearer {os.environ['OPENTYPE_API_KEY']}", "Content-Type": "application/json"},
    json={"name": "ops-dashboard", "scopes": requested},
    timeout=30,
)

body = resp.json()
if resp.status_code == 403 and body["error"]["code"] == "scope_exceeds_creator":
    # The message names the scope you do not hold, e.g. "... the scope billing_write".
    raise RuntimeError(f"Drop the scope or ask an admin: {body['error']['message']}")
if not resp.ok:
    raise RuntimeError(f"{body['error']['code']}: {body['error']['message']}")
print(body["id"])