Scopes are the permissions the credential carries. apikey path only; never null on that path ([] when the provider reported none).
List<String> scopes;