Set creative values

An API key from Settings → API keys, sent as Authorization: Bearer rsk_….

Authorization has two independent axes.

The scope is ranked — a key satisfies any requirement at or below its own tier:

• read — every GET.
• write — launch ads PAUSED, sync, pull history, edit thresholds, Values, briefs, tests, swipes and research.
• admin — everything write can. No operation requires more than write today.

There is no approve scope. It was a rung once; it is not one now, and a key requested with it is rejected.

The approval grant (can_approve) is a separate boolean, not a rung. Changing spend on Meta — activating a launch, pausing or resuming ads, retargeting an ad set, or rebuilding a launch's live creative — needs write and the grant. Keeping them on separate axes is what makes the review gate a control rather than a convention: a key that may propose is not automatically a key that may approve its own proposal.

A key reaches the one workspace — one Meta ad account — it was minted in, and stops working when the operator who minted it leaves the workspace. The same key authenticates the MCP endpoint (/api/mcp) for a headless agent, with the same scope and grant.