Access Token Permissions
When you create an access token in Control Center, the Permission Type list shows a HYPR Affirm group on tenants that have HYPR Affirm enabled. This page explains what each of those permissions grants and gives the OAuth scope that goes with it.
For how to create a token and choose its permissions, see Access Tokens. For the Control Center and Application permissions on the same dialog, see Token Permissions.
Select All ticks every permission in the list, not just the group you are looking at, so a token meant to read login events also gains the permissions on this page. Tick the specific permissions the integration needs instead.
Each area splits into read-only and read/write, so an integration that only needs to read a configuration never needs the permission to change it.
| Permission | OAuth scope | What a token with this permission can do | In the API collection |
|---|---|---|---|
| Manage Affirm | hypr:affirm:admin | Full control of Affirm configuration. Equivalent to holding every other Affirm permission. | all Affirm folders |
| Read-only Affirm Verification Flows | hypr:affirm:readVerificationFlow | Read verification flows and their step configuration. | Verification Flows |
| Read/write Affirm Verification Flows | hypr:affirm:writeVerificationFlow | Create, change, and delete verification flows. | Verification Flows |
| Read-only Affirm User Flows | hypr:affirm:readUserFlow | Read the user flows raised against verification flows. | Single User Workflows |
| Read/write Affirm User Flows | hypr:affirm:writeUserFlow | Raise and change user flows, which is how an integration starts a verification for a requester. Also unblocks a requester who has hit the retry limit. | Single User Workflows |
| Read-only Affirm Workflow | hypr:affirm:readWorkflow | Read workflow results, including the outcome of a completed verification. | Workflow Management |
| Read/write Affirm Workflow | hypr:affirm:writeWorkflow | Change workflow results. | Workflow Management |
| Read-only Affirm Activity Log | hypr:affirm:readAffirmActivityLog | Read the Affirm activity log. | IDV Results |
| Read-only Affirm Code Customization | hypr:affirm:readCodeCustomization | Read registered code customizations. | Code Customization |
| Read/write Affirm Code Customization | hypr:affirm:writeCodeCustomization | Register, change, and remove code customizations. | Code Customization |
| Test Affirm Code Customization | hypr:affirm:testCodeCustomization | Run a code customization against test input. | Code Customization |
| Read-only Affirm Content Customization | hypr:affirm:readContentCustomization | Read the text and branding shown to requesters, including kit screens and stylesheets. | Content Customization Kits |
| Read/write Affirm Content Customization | hypr:affirm:writeContentCustomization | Create, change, duplicate, and delete content customization kits. | Content Customization Kits |
| Read-only Affirm OIDC Client Config | hypr:affirm:readOidcClientConfig | Read the OIDC client configurations Affirm uses. | OIDC Client Config |
| Read/write Affirm OIDC Client Config | hypr:affirm:writeOidcClientConfig | Create and change OIDC client configurations. | OIDC Client Config |
| Read-only Affirm Advanced Location Configuration | hypr:affirm:readAdvancedLocationConfig | Read the known locations and country block lists used by network and location policy. | Known Locations, Country Block Lists |
| Read/write Affirm Advanced Location Configuration | hypr:affirm:writeAdvancedLocationConfig | Create, change, and delete known locations and country block lists. | Known Locations, Country Block Lists |
| Read-only Affirm Asset Configuration | hypr:affirm:readAsset | Read uploaded assets, such as images used in a flow. | Assets |
| Read/write Affirm Asset Configuration | hypr:affirm:writeAsset | Create, change, and delete assets. | Assets |
Three further Affirm scopes belong to the Affirm policy engine, which is in preview. These appear in the HYPR Affirm group as bare identifiers with no description beneath them, so they are listed here by the identifier you will see:
| Shown in Control Center as | OAuth scope | What a token with this permission can do | In the API collection |
|---|---|---|---|
AFFIRM_READ_POLICY_LEDGER | hypr:affirm:readPolicyLedger | Read the policy ledger for a workflow. | Policy Ledger |
AFFIRM_READ_POLICY_EVALUATION_KIT | hypr:affirm:readPolicyEvaluationKit | Read policy evaluation kits and the risk signals available to them. | Policy Evaluation Kits |
AFFIRM_WRITE_POLICY_EVALUATION_KIT | hypr:affirm:writePolicyEvaluationKit | Create, change, duplicate, and delete policy evaluation kits. | Policy Evaluation Kits |
The Access Tokens list shortens these names and marks the level of access with a letter, where (R) is read-only and (R/W) is read/write.
For what these objects are, see HYPR Affirm.