When working with Paddle, it’s best practice to follow the principle of least privilege. Only grant the minimum permissions your application requires. This limits security risks while keeping your integration functional.
Below is the table of recommended minimum permissions and the reasons they’re needed.
Minimum Paddle API Permissions
Name | Permission | Reason |
Client-side Tokens | Write | Generate tokens to securely interact with Paddle from the client side. |
Customer Portal Sessions | Write | Create sessions that allow customers to manage their subscriptions. |
Customer Authentication Tokens | Write | Generate authentication tokens for secure customer logins. |
Customers | Write | Create and update customer records. |
Discounts | Read | Retrieve discount and coupon details during checkout. |
Notification Settings | Write | Configure notification settings for events and alerts. |
Notifications | Write | Manage and send webhook-style notifications to external systems. |
Prices | Read | Fetch price information for products and subscriptions. |
Products | Read | Retrieve product catalog details for display and checkout. |
Subscriptions | Write | Create and manage customer subscriptions. |
Transactions | Write | Record and manage payment transactions. |