BetaTesting API credentials have defined access rights.
API access is only available to select plans
Every credential can read your tests, testers, activities, and issues.
Creating or changing anything through the API requires write access, which is available when your plan includes the feature. This lets you hand out read-only credentials to reporting tools and keep write access for the integrations that need it.
How to create a read-only or read-and-write static token
Open Integrations from the company menu and select the BetaTesting API tab.
Under Static Token, click Create Static Token
Enter a Name for the token.
Under Access, choose Read only or Read and write. Read and write is only available when your plan includes the "Allow write actions via API" feature.
Click Create. Copy the value that starts with btst_ from the banner and store it safely. It is not shown again.
The Static Token card shows the token's Access level along with when it was created and last used.
How to request write access with an OAuth2 client
On the same BetaTesting API tab, create a client under OAuth2 Clients with Create Client if you do not have one yet, and copy the Client ID and Client Secret.
When your integration requests a token from POST /api/external/v2/oauth/token with the client credentials grant, include scope set to read write (or just read for read-only tokens).
If your plan includes the "Allow write actions via API" feature, the token is issued with both scopes. If it does not, the request is rejected with an invalid_scope error explaining that the write scope requires the feature. Request read instead, or contact us to add write access to your plan.
If you leave scope out of the request, the token is issued with read only.
Things to know
Read access is always included. There is no write-only credential.
A static token's access level is fixed when it is created. To change it, delete the token and create a new one.
Write access is checked on every request. If the "Allow write actions via API" feature is removed from your plan, existing credentials immediately become read-only, including OAuth2 tokens that were issued with the write scope. The Static Token card then shows Read and write (write disabled by your plan)
A write request made without write access returns a **403** response. The error says **Insufficient scope** when the credential itself is read-only, and **Write actions via API are not enabled for your subscription** when your plan does not include write access. Both responses include a **required_scope** field set to **write**.
Static tokens created before this change keep the read-and-write level they had. Whether they can actually write depends on your plan, as described above.
The API reference at /api/external/v2/documentation describes both authentication methods. In its Authorize dialog, selecting the write scope for an OAuth2 client on a plan without write access shows the same invalid_scope error.