Authentication

Create a key

1. Open the workspace you want to post to, then go to Settings and API keys.
2. Choose New key, give it a name you’ll recognise later (like the tool that uses it), and pick its access.
3. Copy the key. It’s shown once; if you lose it, revoke it and create a new one.

Keys look like 12|pzk_8fJd…. Each person can have up to 20 keys in a workspace.

Send the key

Put the key in the Authorization header as a Bearer token. Requests without one, or with a revoked key, get a 401.

curl -G https://api.postzora.com/api/public/v1/posts \
  -H "Authorization: Bearer $POSTZORA_API_KEY" \
  --data-urlencode "status=scheduled"

const response = await fetch(`https://api.postzora.com/api/public/v1/posts?${new URLSearchParams({ status: 'scheduled' })}`, {
  headers: {
    Authorization: `Bearer ${process.env.POSTZORA_API_KEY}`,
  },
})
const { data } = await response.json()

import os

import requests

response = requests.get(
    "https://api.postzora.com/api/public/v1/posts",
    headers={"Authorization": f"Bearer {os.environ['POSTZORA_API_KEY']}"},
    params={"status": "scheduled"},
)
data = response.json()["data"]

Sign-in cookies from the app don’t work on the API, and API keys don’t work in the app. Each only opens its own door.

Read and write access

Give each key only the access its job needs:

• Read only keys can list channels, posts and media, and find free posting times.
• Read and write keys can also create, change and delete posts, and upload media.

A read only key that tries to change something gets a 403 with the code read_only_key.

Workspaces and roles

A key works in the workspace it was created in, and nowhere else, whichever workspace you have open in the app. To post to another workspace, create a key there.

The key can do what you can do in that workspace, with your role:

• Viewers can read, but not create posts, whatever the key’s access.
• When the workspace requires approvals, posts scheduled by editors wait for review, exactly as they do in the app.
• If you leave the workspace, or your account is suspended, your keys stop working.

Keep keys safe

• Store keys in environment variables or your tool’s secret settings, never in code you commit or share.
• Use one key per tool, so you can revoke one without breaking the others.
• Check last used in Settings, and revoke keys nothing uses any more.