# Valid scopes for invenio tokens create **URL:** \ **Category:** Invenio RDM\ **Created:** [1 March 2024 12:58 UTC](https://invenio-talk.web.cern.ch/t/valid-scopes-for-invenio-tokens-create/352 "2024-03-01T12:58:36Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![dalpra](https://invenio-talk.web.cern.ch/letter_avatar_proxy/v4/letter/d/d6d6ee/32.png) [@dalpra](https://invenio-talk.web.cern.ch/u/dalpra)\ **Post date:** [1 March 2024 12:58 UTC](https://invenio-talk.web.cern.ch/t/valid-scopes-for-invenio-tokens-create/352/1 "2024-03-01T12:58:37Z")
Hi to all, what are the recognized scopes for invenio tokens create? (using v11.0) I get ScopeDoesNotExists exception when attempting invenio tokens create -n mytoken -u user@email -s “upload” or other similar attempts; also: what is the “-internal” option? Thanks ---
**Author:** ![nitarocc](https://invenio-talk.web.cern.ch/letter_avatar_proxy/v4/letter/n/9e8a1a/32.png) [@nitarocc](https://invenio-talk.web.cern.ch/u/nitarocc)\ **Post date:** [1 March 2024 13:22 UTC](https://invenio-talk.web.cern.ch/t/valid-scopes-for-invenio-tokens-create/352/2 "2024-03-01T13:22:28Z")
Hello, do you need to use scope for anything in particular? In general, there are no scopes defined at the moment. We discussed internally about this and we might add scopes in the future. ---
**Author:** ![dalpra](https://invenio-talk.web.cern.ch/letter_avatar_proxy/v4/letter/d/d6d6ee/32.png) [@dalpra](https://invenio-talk.web.cern.ch/u/dalpra)\ **Post date:** [1 March 2024 15:55 UTC](https://invenio-talk.web.cern.ch/t/valid-scopes-for-invenio-tokens-create/352/3 "2024-03-01T15:55:11Z")
Hi, I thought that could be an alternative to the token created from the dashboard, where “user:email” is the only scope that can be selected. In general, I’m interested at content upload capabilities. ---
**Author:** ![zzacharo](https://invenio-talk.web.cern.ch/user_avatar/invenio-talk.web.cern.ch/zzacharo/32/227_2.png) [@zzacharo](https://invenio-talk.web.cern.ch/u/zzacharo)\ **Post date:** [1 March 2024 16:08 UTC](https://invenio-talk.web.cern.ch/t/valid-scopes-for-invenio-tokens-create/352/4 "2024-03-01T16:08:35Z")
Hey @dalpra , you are correct the token is selectable in the UI, but in reality as my colleague @nitarocc said, there is no scope based access control yet. You should be able to upload content with the issued token. Did you experience any particular problem? ---
**Author:** ![dalpra](https://invenio-talk.web.cern.ch/letter_avatar_proxy/v4/letter/d/d6d6ee/32.png) [@dalpra](https://invenio-talk.web.cern.ch/u/dalpra)\ **Post date:** [1 March 2024 16:57 UTC](https://invenio-talk.web.cern.ch/t/valid-scopes-for-invenio-tokens-create/352/5 "2024-03-01T16:57:44Z")
Hi @zzacharo , probably i’m too inexperienced; an old zenodo instance has three selectable scopes: deposit:actions, deposit:write, user:email. with v11.0 however, only user:email appears; that made me think that capabilities were defined and considered. Maybe that part was customized in the old instance. I succeded uploading via api to the old instance, and starting with now with the new one; I just found the “invenio token create” command line and was curious if it was equivalent the ones created from the web dashboard. Looks like yes, thought. ---
**Author:** ![zzacharo](https://invenio-talk.web.cern.ch/user_avatar/invenio-talk.web.cern.ch/zzacharo/32/227_2.png) [@zzacharo](https://invenio-talk.web.cern.ch/u/zzacharo)\ **Post date:** [5 March 2024 16:55 UTC](https://invenio-talk.web.cern.ch/t/valid-scopes-for-invenio-tokens-create/352/6 "2024-03-05T16:55:05Z")
Hey @dalpra! The `invenio token create` command indeed creates the tokens you have seen in the old zenodo instance and also in the v11. What is missing now, is to connect any permission check with the existence of a specific scope. So, creating tokens now in reality doesn’t alter the access rules to a user. Did you manage to upload content also in the v11 or later RDM instance? Do you experience still problems uploading in your instance?