Guides
Authentication
Personal API keys, scopes, and the rules they follow.
Authenticate with a personal API key. Create one in the dashboard under Settings → API Keys (this requires any paid plan: Starter, Pro, or Team). Pass the key as a bearer token on every request:
Authorization: Bearer <your-api-key>Key rules
- One active key per workspace. Creating a second key while one is active
returns
422 API_KEY_LIMIT_REACHED; revoke the existing key first. - Keys are pinned to the workspace that created them. If you leave that
workspace, the key stops working and returns
403 WORKSPACE_FORBIDDEN. - The secret is shown once, at creation. Store it securely; it cannot be retrieved again.
- Keys never expire but can be revoked from the dashboard at any time.
- A key whose account later loses API access is rejected at use with
401 UNAUTHORIZED.
Scopes
Each key carries a fixed set of scopes chosen at creation. A request that
exceeds a key's scopes returns 403 INSUFFICIENT_SCOPE. Endpoints document
the scope they require.
| Scope | Grants |
|---|---|
posts:read | List and read posts; read the next available posting slot |
posts:write | Create, update, delete, bulk-create, and approve/reject posts |
ai:generate | Generate post content, threads, batches, and carousels |
publish:write | Publish posts now or to a slot; upload media |
accounts:read | List connected social accounts; search IG audio; list boards |
analytics:read | Read analytics rollups, timeseries, and best-time data |
preferences:read | Read generation preferences |
preferences:write | Update generation preferences |
platform_styles:read | Read per-platform style profiles |
platform_styles:write | Update or reset per-platform style profiles |
rules:read | List and read custom rules |
rules:write | Create, update, delete, and toggle custom rules |
schedules:read | Read posting schedules |
schedules:write | Update a posting schedule |
plans:read | Read content plans |
voice:read | Read the voice profile |
communities:read | List saved X (Twitter) communities |
billing:read | Read the current subscription and quota |
image_week:read | List and read Quote Week (image generation) runs |
image_week:write | Start, cancel, and regenerate items in Quote Week runs |
What a key cannot do
Key management, billing mutations, and account-identity endpoints are
intentionally not reachable with an API key; those require a dashboard
session. Endpoints not opted into API-key access return
403 ENDPOINT_NOT_AVAILABLE. Connecting and disconnecting social accounts is
dashboard-only too.