# Key owners and scope

A key belongs to exactly one owner, and the owner decides what the key can see. There is no separate "client"
record\: each key carries its owner and a label so you can tell your integrations apart.

| Owner | Brands the key reaches |
| --- | --- |
| **Franchisor** | Its own brand |
| **Platform** | Every brand under the platform, re-resolved as brands join or leave |
| **Partner** | Each brand with an active [connection](/concepts/partners) to the partner |

Archived and prospect brands are never in scope. `GET /v1/me` returns the brand ids a key reaches right now in
`franchisor_ids`.

## How scope is enforced

Scope is part of every database query, not a check after the fact. A request for an id outside your scope gets
the same `404 not_found` as an id that does not exist, so ids can't be probed. List endpoints only ever return
rows in scope.

## Limits per owner

Rate limits apply per owner, not per key\: two keys of the same brand share one budget. See
[Rate limits](/conventions/rate-limits).