# Authentication and API keys

> Every REST API request is authenticated with an API key sent as a Bearer token. Keys are created and revoked in Postprism on the Freelancer and Agency plans.

**Source:** https://postprism.app/docs/authentication  
**Updated:** 2026-10-10

---

## Send your key as a Bearer token

**Header**

```
Authorization: Bearer pp_live_your_api_key
```

Every endpoint needs this header. A missing, malformed or revoked key returns `401` with `"error": "Invalid or revoked API key"`.

## Which plans include API keys

| Plan | REST API keys | MCP server |
| --- | --- | --- |
| Solo | No | Yes |
| Freelancer | Yes | Yes |
| Agency | Yes | Yes |

The MCP server signs in with your Postprism account instead of a key, so it works on every plan, including the free trial. See [MCP server](https://postprism.app/docs/mcp).

## Create a key

1. In Postprism, open **Developer** in the sidebar.
2. Choose **Generate API key** and name it after where it will be used.
3. Copy the key. It starts with `pp_live_` and is shown only once; if you lose it, revoke it and create a new one.

A key belongs to you and is tied to the workspace you were in when you created it. That workspace is the default for every request; see [Workspaces](https://postprism.app/docs/workspaces) to act on others.

## Revoke a key

On the Developer page, choose **Revoke key** next to the key. It stops working immediately. Create one key per integration so you can revoke one without breaking the others.

## Keep keys secret

- A key can create, change and delete posts in every workspace you belong to. Treat it like a password.
- Call the API from a server, script or automation tool, never from code that runs in a browser or ships in an app.
- Store keys in environment variables or your platform’s secret store, not in source control.
- Removing someone from a workspace also stops their keys from reaching that workspace.