Authentication

Send your key as x-api-key on every request:

curl https://app.postonus.com/api/v1/users/me \
  -H "x-api-key: $POSTONUS_API_KEY"

Leave it off, or send an invalid one, and every operation answers 401 UNAUTHORIZED.

Keys are scoped to one workspace

A key is bound to (the user who created it, one workspace) at creation time — never to "whichever workspace is active right now." There is no organizationId argument on any request: the workspace is the credential, not something you pick per call. If you work across several workspaces, create one key per workspace.

This is deliberate. A key that could reach every workspace its creator belongs to would grant more than the person who leaked it intended, and would still work against a workspace after its creator left. Because the workspace is baked into the key, removing a member from a workspace revokes that member's keys for it in the same step.

Create and revoke a key

Key management is a dashboard-only operation — it needs a signed-in session, not an API key, so a leaked key can never mint another key for itself. Create and revoke keys from Developer API in the dashboard sidebar:

• Create — name it, optionally set an expiry (1–365 days), and copy the plaintext key. It is shown once.
• Revoke — immediate. A revoked key fails every subsequent request with 401.
• Leaving a workspace revokes every key you hold for it.

An organization can hold at most 25 live keys; see Rate limits.

What a key can reach

A key reaches posts, schedules, channels, uploads, tag reads, usage, and /users/me — the operations an external script needs. It cannot manage other keys, billing, or workspace membership, even for the workspace it belongs to. See Public surface for the exact list and why an operation outside it answers 404 rather than 403.

Other ways to authenticate

• CLI — postonus login opens a browser and stores a session token instead of a key. A session reaches the full operation set a dashboard user would, not only the public surface — set POSTONUS_API_KEY if you want CLI calls scoped the same way a key is. See CLI install.
• MCP — an interactive assistant connects over OAuth instead of a pasted key; a server-to-server MCP caller can still send x-api-key. See MCP.