Skip to content

A button/action is missing because of role or API-key scope

CanvasRelay enforces permissions on the server; hiding a control is often the UI reflection of the current owner/admin/editor/viewer role or API-key scopes.

What you may be seeing

  • A teammate cannot edit/manage an area, or an API-key session can read but not write.

What usually causes it

  • The user's organization role lacks the action.
  • An API key was minted without the required scope.
  • Some sensitive actions require a session sign-in/owner role rather than an API-key connection.

Do this

  1. Open Settings → Team and confirm the user's role.
  2. Owners/admins can grant the minimum appropriate role; do not make someone owner just to solve an unrelated editing problem.
  3. For API integrations, inspect the key's scope chips. Mint a new appropriately scoped key if needed; a key's raw value cannot be recovered later.
  4. For account-only settings, sign in with the user session rather than expecting an API-key connection to manage personal account state.

You know it is fixed when

  • The user/key has the required scope/role and the action succeeds without CR-1004.

Search phrases this guide covers

permission denied · CR-1004 · button missing · viewer can't edit · API key scope