Omitting scopes uses the default partner API-key permission set. Additional opt-in scopes, including billing:partner:allocate and call_traces:admin_read, are advertised by GET /api/v1/api_key_permissions.
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.