Which Storefront API access scope can mutate cart attributes?

Exactly @Dylan - you’re on point, basically any one of those unaunthenticated… scopes should work.

Personally, I generally just enable all the unauthenticated storefront scopes when I set up a new app if I’m going to be using the SFAPI from the get go - I don’t know if it’s confirmed best practice, but that’s what I’ve seen a lot of partner devs do as well, so I think it’s safe to share that as a recommendation just from my perspective here.

The checkout object being referenced in the docs there is likely the deprecated checkout object (there’s a bit more on this here).

My understanding is that the storefront checkout API has been fully sunset, so I’m thinking the reference to it there is most likely due to legacy reasons, but I’ll speak with some folks on our end here to see if that should be removed or if there is a reason we can share for that still being present in the docs - thanks for flagging though, much appreciated!