API keys follow the permissions you can grant

When you create or edit an API key, its permissions must stay within your own access, including shop and project restrictions. Managing keys requires the corresponding API key permission in your role.

Roles already granted API Keys access can now use those permissions without being organization admins. Use Use my permissions in the key editor to copy your existing restrictions before removing actions the key does not need.

Order notes also follow your access to the order. Viewing a note requires permission to view its order, and adding, editing, or deleting a note requires permission to edit that order.

Notes remain readable in a read-only editor when you cannot edit their order.