From fbde7240354818bbb68505f56a5389fe4b09f027 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?batuhan=20i=C3=A7=C3=B6z?= Date: Fri, 13 Nov 2026 02:49:53 +0100 Subject: [PATCH] Say Spaces in permission copy, and match the CLI login output The approval screens now say Spaces, and Agent access names Sell, team invites, and connected services. The MCP default scope table lists every scope a client asks for today. The sf login example matches what the CLI prints, and the --json action line goes to stderr. --- content/agents/mcp-server.mdx | 17 +++++++++++------ content/agents/permissions.mdx | 2 +- content/api/authentication.mdx | 8 ++++---- content/cli/login.mdx | 17 ++++++++--------- 4 files changed, 24 insertions(+), 20 deletions(-) diff --git a/content/agents/mcp-server.mdx b/content/agents/mcp-server.mdx index 7896f0fd..9b9344f5 100644 --- a/content/agents/mcp-server.mdx +++ b/content/agents/mcp-server.mdx @@ -39,13 +39,18 @@ By default a client asks for these scopes. |---|---| | `teams:read` | Read the teams the account belongs to | | `teams:create` | Create teams | -| `spaces:read` | Read spaces, versions, and build status | -| `spaces:write` | Create and update spaces and their settings | -| `spaces:rename` | Rename space slugs and managed addresses | +| `teams:members.write` | Invite people to teams that the account can administer | +| `sell:write` | Set up Sell, enable live sales, resend downloads, and mark orders shipped | +| `spaces:read` | Read Spaces, versions, and build status | +| `spaces:write` | Create and update Spaces and their settings | +| `spaces:rename` | Rename Space slugs and managed addresses | +| `spaces:access.write` | Change who can open a Space, including making it public through its published configuration | +| `versions:download` | Read files from deployment versions | | `publish:write` | Publish new immutable versions | -| `domains:read` | Read domain inventory and DNS diagnostics | -| `domains:write` | Attach, verify, and mutate domains and DNS records | -| `offline_access` | Refresh access without another sign-in | +| `domains:read` | Read Space hostnames and certificate status. Read domain registrations and DNS records when enabled | +| `domains:write` | Manage Space hostnames. Start domain purchases and manage DNS records when enabled | +| `oauth-apps:write` | Register and manage the team's Sign in with Spacefast apps | +| `offline_access` | Refresh access without another interactive sign-in | Each tool declares the scopes it needs, and clients can read them from `tools/list` before calling. diff --git a/content/agents/permissions.mdx b/content/agents/permissions.mdx index f55cac2a..c18439ce 100644 --- a/content/agents/permissions.mdx +++ b/content/agents/permissions.mdx @@ -22,7 +22,7 @@ Device login is covered step by step in [sign in and security](/authentication). Interactive approval screens ask for two things: how much the agent may do, and where. -**Access.** The device page names the profile it asked for. **Read-only access** reads your teams, sites, and domains and changes nothing. **Agent access** can create and publish sites, manage domains and DNS, create teams, and use Spacefast tools. Its own limits line says it cannot delete sites, manage team members, change billing, or mint credentials. +**Access.** The device page names the profile it asked for. **Read-only access** reads your teams, Spaces, and domains and changes nothing. **Agent access** can create and publish Spaces, manage their access and domains, invite team members, create teams, manage Sell, and act on the services your team connected. Its limits line says it asks you before it deletes a Space, a team admin confirms every purchase, and it can't remove team members or change roles or billing. **Teams.** You pick **All teams** ("Includes teams you join or create later"), **Choose teams** with a picker, or **No team access** ("Sign-in only. This device can't touch any team"). diff --git a/content/api/authentication.mdx b/content/api/authentication.mdx index cba08d90..c3877055 100644 --- a/content/api/authentication.mdx +++ b/content/api/authentication.mdx @@ -131,11 +131,11 @@ Authorization code is the flow for people, client credentials for machines. The | --- | --- | | `teams:read` | Read the teams the account belongs to. | | `teams:create` | Create teams. | -| `spaces:read` | Read spaces, versions, and build status. | -| `spaces:write` | Create and update spaces and their settings. | -| `spaces:rename` | Rename space slugs and managed addresses. | +| `spaces:read` | Read Spaces, versions, and build status. | +| `spaces:write` | Create and update Spaces and their settings. | +| `spaces:rename` | Rename Space slugs and managed addresses. | | `publish:write` | Publish new immutable versions. | -| `spaces:publish` | Publish a version to an existing space. | +| `spaces:publish` | Publish a version to an existing Space. | | `builds:trigger` | Start a build for an existing version. | | `domains:read` | Read domain inventory and DNS diagnostics. | | `domains:write` | Attach, verify, and mutate domains and DNS records. | diff --git a/content/cli/login.mdx b/content/cli/login.mdx index 2769f49b..6e55aaee 100644 --- a/content/cli/login.mdx +++ b/content/cli/login.mdx @@ -33,17 +33,16 @@ sf login ``` ```text -Signing in to https://api.spacefast.com. -Requesting Agent access — create and publish sites, manage domains and DNS, create teams, and use Spacefast tools. -Complete device login in your browser. -Code: XXXX-XXXX -Link: https://…/device -Opened your browser. + Sign in to Spacefast + Opened https://…/device + Code XXXX-XXXX · check it matches + +✓ Signed in as Ada Lovelace · Acme ``` All of that goes to stderr. Only the approving side needs a browser, so this works over SSH and in containers. When the CLI cannot open one it says so, tells you to approve the link from any device, and waits. [Sign in and security](/authentication#log-the-cli-in) has the code lifetime, the poll cadence, and the lifetime of the credential you end up with. -With `--json`, one line goes to stdout before the poll blocks, so an agent can hand the code to a person: +With `--json`, one line goes to stderr before the poll blocks, so an agent can hand the code to a person: ```json {"requiresAction":{"actionType":"device_authorization","verificationUrl":"…","userCode":"…","interval":5,"expiresAt":"…"}} @@ -53,8 +52,8 @@ With `--json`, one line goes to stdout before the poll blocks, so an agent can h | `--access` | Grants | | --- | --- | -| `read` | Read your teams, sites, and domains. Changes nothing. | -| `agent` (default) | Create and publish sites, manage domains and DNS, create teams, and use Spacefast tools. It cannot delete sites, manage team members, change billing, or mint credentials. | +| `read` | Read your teams, Spaces, and domains. Changes nothing. | +| `agent` (default) | Create and publish Spaces, and manage their access and domains. Invite team members, create teams, manage Sell, and act on the services your team connected. It asks you before it deletes a Space, and a team admin confirms every purchase. It can't remove team members or change roles or billing. | The approval page shows the same scopes and lets you narrow them.