I added a secondary user and gave them "API permissions". They can now login, navigate all the way to the PayPal button tools, even start creating one.
But eventually, during the last step, it fails with an error that they don't have the proper permissions.
So which one(s) do I need to assign? None of the listed ones explicitly state that they will enable managing buttons or other tools.
