# Access

> What read and write keys and grants can do.

Source: https://www.onlucra.com/docs/access

Every API key and OAuth grant has one of two access levels. Each endpoint in the reference is marked with the level it needs.

| Access  | Allows           |
| ------- | ---------------- |
| `read`  | Every read       |
| `write` | Reads and writes |

Start a new integration or an AI agent on `read`, and move to `write` once you trust it with every write, including ones that move money.

## OAuth tokens

An [OAuth](https://www.onlucra.com/docs/oauth) grant is `read` or `write` too, and a token never does more than the person who granted it. Owners and admins can do everything; other members read everything but payments, and can't make changes.

## Acting as a creator

A partner acts for a roster creator with `Lucra-Account: crtr_…`. That needs a `write` key, even for reads, and works only on endpoints marked for creators. See [Partners](https://www.onlucra.com/docs/api-partners#act-as-a-creator).

## What stays in the app

Managing your team, API keys and OAuth apps happens in the Lucra app.

Card and bank details, identity checks and platform sign-ins happen on hosted pages, so they never pass through your server. `POST /v1/connections` returns the page to send the person to, and a [webhook](https://www.onlucra.com/docs/webhooks) tells you when they're done.