Working with the Cloud API, we came across a subtle problem that cost us a few hours.  Of course, with the Web API every problem is subtle, hopefully this fills in a gap.

We set up a service account, created an application with the service principal, and granted the account repository.Read and repository.Write permissions, and also (probably not necessary) added the service account to a group with full access to the repo.

When you create the key, it says:

So you go to https://signin.laserfiche.com/oauth/swagger/index.html

and set the grant type:

Good?

Nay, nay! 

When you switch to the API and run anything, you will get "Access Denied".  You need to set the scope again:

Then you can run the API, here just getting the Repo name:

Which is much better than:

As they say on despair.com, "It could be that the purpose of your life is only to serve as a warning to others."