Authentication and API keys

Every REST API request is authenticated with an API key sent as a Bearer token. Keys are created and revoked in Postprism on the Freelancer and Agency plans.

Last checked against the API October 10, 2026 · View as Markdown

Send your key as a Bearer token

Header
Authorization: Bearer pp_live_your_api_key

Every endpoint needs this header. A missing, malformed or revoked key returns 401 with "error": "Invalid or revoked API key".

Which plans include API keys

PlanREST API keysMCP server
SoloNoYes
FreelancerYesYes
AgencyYesYes

The MCP server signs in with your Postprism account instead of a key, so it works on every plan, including the free trial. See MCP server.

Create a key

  1. In Postprism, open Developer in the sidebar.
  2. Choose Generate API key and name it after where it will be used.
  3. Copy the key. It starts with pp_live_ and is shown only once; if you lose it, revoke it and create a new one.

A key belongs to you and is tied to the workspace you were in when you created it. That workspace is the default for every request; see Workspaces to act on others.

Revoke a key

On the Developer page, choose Revoke key next to the key. It stops working immediately. Create one key per integration so you can revoke one without breaking the others.

Keep keys secret

  • A key can create, change and delete posts in every workspace you belong to. Treat it like a password.
  • Call the API from a server, script or automation tool, never from code that runs in a browser or ships in an app.
  • Store keys in environment variables or your platform’s secret store, not in source control.
  • Removing someone from a workspace also stops their keys from reaching that workspace.
PreviousQuick startNextWorkspaces